Ports ci.yml and publish.yml after the GitHub account was suspended and
ghcr.io/coffey-labs/ihasvpn went dark with it. The deployment on Web_Host
was still pulling that tag, and the only surviving copy was the image
already on the host -- amd64 only. This rebuilds the multi-arch tag.
The workflow built each platform on a native runner; there is one amd64
runner here, so arm64 goes through QEMU. Slower, and tag-driven for that
reason, but shipping amd64 only is exactly what the suspension already cost
us once.
The Actions workflows stay in the tree as the reference.
jcoffey-dev