ci: publish multi-arch Docker image to GHCR, fix docs to match #1

	name: Docker publish

	# Builds the multi-arch (amd64 + arm64) image from the repo Dockerfile. On PRs it
	# only builds (catches cross-arch build breaks early, e.g. an amd64-only step
	# slipping back in). On push to main it also pushes to GHCR, tagged `latest` and
	# the short commit SHA.
	on:
	push:
	branches: [main]
	pull_request:

	concurrency:
	group: docker-publish-${{ github.ref }}
	cancel-in-progress: true

	env:
	REGISTRY: ghcr.io
	# Hardcoded lowercase — GHCR tags reject the repo's actual "Calnode/calnode"
	# casing (${{ github.repository }} would break the push).
	IMAGE_NAME: calnode/calnode

	jobs:
	build:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	packages: write
	steps:
	- uses: actions/checkout@v4

	- uses: docker/setup-qemu-action@v3

	- uses: docker/setup-buildx-action@v3

	- name: Log in to GHCR
	if: github.event_name != 'pull_request'
	uses: docker/login-action@v3
	with:
	registry: ${{ env.REGISTRY }}
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Build (and push on main)
	uses: docker/build-push-action@v6
	with:
	context: .
	platforms: linux/amd64,linux/arm64
	push: ${{ github.event_name != 'pull_request' }}
	tags: \|
	${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
	${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}

Provide feedback