feat(delivery): publish immutable source images and declare release

.gitea/workflows/build-and-push.yml

@@ -60,6 +60,7 @@ jobs:
         run: |
           short_sha="${GITHUB_SHA::7}"
           tags="${REGISTRY}/${IMAGE_NAME}:sha-${short_sha}"
+          tags+=$'\n'"${REGISTRY}/${IMAGE_NAME}:sha-${GITHUB_SHA}"
 
           if [[ "${GITHUB_REF_TYPE}" == "branch" && ("${GITHUB_REF_NAME}" == "master" || "${GITHUB_REF_NAME}" == "main") ]]; then
             tags+=$'\n'"${REGISTRY}/${IMAGE_NAME}:latest"
@@ -84,3 +85,4 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           platforms: linux/amd64,linux/arm64
           tags: ${{ steps.prep.outputs.tags }}
+          labels: org.opencontainers.image.revision=${{ github.sha }}