ci: 建立生产镜像与 Tag 发布流水线

新增独立仓库级 Gitea Runner，main 和 PR 执行完整质量门禁与不可变 SHA 镜像构建；只有来自 main 历史的语义版本 Tag 才调用受限生产发布助手。专属 Buildx builder 将缓存限制为 2 GB。\n\n验证：流水线结构测试、ShellCheck、Go vet/test、govulncheck、前端 lint/test/build、Compose 渲染及高危依赖审计通过。

deploy/ci/easyai-gateway-act-runner.service

@@ -0,0 +1,31 @@
+[Unit]
+Description=EasyAI AI Gateway Gitea Actions runner
+After=network-online.target docker.service
+Wants=network-online.target docker.service
+
+[Service]
+Type=simple
+User=easyai-gateway-runner
+Group=easyai-gateway-runner
+WorkingDirectory=/var/lib/easyai-gateway-runner
+Environment=HOME=/var/lib/easyai-gateway-runner
+Environment=PATH=/opt/easyai-gateway-ci/bin:/opt/easyai-gateway-ci/toolchains/go/bin:/opt/easyai-gateway-ci/toolchains/node/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+# Gitea 1.22 can leave a long-running poll stale after a completed host job.
+# Process exactly one job, then let Restart=always create a fresh poller.
+ExecStart=/opt/easyai-gateway-ci/bin/gitea-runner --config /etc/easyai-gateway-runner/config.yaml daemon --once
+Restart=always
+RestartSec=5s
+TimeoutStopSec=330s
+# Tag jobs invoke one SHA-validating root helper. Docker access already gives
+# this dedicated repository runner an equivalent host-root trust boundary.
+NoNewPrivileges=false
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
+ReadWritePaths=/var/lib/easyai-gateway-runner
+
+[Install]
+WantedBy=multi-user.target