Adopt commit-based container tags (#232)

## Summary
- Replace git-tag-triggered container builds with path-based triggers on main and workflow_dispatch
- Image tags now encode upstream app version + commit SHA (`vX.Y.Z-<sha>`) for full traceability
- Replace `container-tag-and-release` task with `container-build-and-release` (dispatches workflows via Forgejo API)
- Update dagger `publish()` to accept `commit_sha` parameter
- Update all docs and references to the new workflow

## Deployment and Testing
- [ ] Merge to main
- [ ] `mise run container-build-and-release <name>` for each container to populate new-format tags
- [ ] Verify tags in registry via `mise run container-list`
- [ ] Existing images untouched — old tags remain available

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/232

mise-tasks/service-review

@@ -168,7 +168,7 @@ def main(
         checklist_parts += [
             "\n[bold]Custom Container (hybrid):[/bold]\n",
             "• Check base image for updates\n",
-            "• Rebuild container if needed: mise run container-tag-and-release\n",
+            "• Rebuild container if needed: mise run container-build-and-release\n",
             "• Update ArgoCD manifest with new image tag\n",
         ]
     elif svc_type == "argocd":