Fix CI: use crane to mirror image (no Docker daemon in runner)

The Gitea Actions runner container lacks Docker. Use crane
(daemonless) to copy the upstream FleetDM image directly to
the Gitea OCI registry.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/release.yaml

@@ -123,19 +123,19 @@ jobs:
 
       - name: Mirror FleetDM image to Gitea registry
         run: |
+          CRANE_VER="v0.20.3"
+          curl -fsSL "https://github.com/google/go-containerregistry/releases/download/${CRANE_VER}/go-containerregistry_Linux_x86_64.tar.gz" \
+            | tar -xz -C /usr/local/bin crane
+
           APP_VER=$(grep '^appVersion:' fleetdm-stack/Chart.yaml | awk '{print $2}' | tr -d '"')
           CHART_TAG="${{ steps.version.outputs.new_tag }}"
-          SRC="fleetdm/fleet:v${APP_VER}"
+          SRC="docker.io/fleetdm/fleet:v${APP_VER}"
           DST="git.produktor.io/${{ gitea.repository }}/fleet"
 
-          echo "${{ gitea.token }}" | docker login git.produktor.io -u "${{ gitea.actor }}" --password-stdin
+          crane auth login git.produktor.io -u "${{ gitea.actor }}" -p "${{ gitea.token }}"
-          docker pull "${SRC}"
+          crane copy "${SRC}" "${DST}:${APP_VER}"
-          docker tag "${SRC}" "${DST}:${APP_VER}"
+          crane tag  "${DST}:${APP_VER}" "${CHART_TAG}"
-          docker tag "${SRC}" "${DST}:${CHART_TAG}"
+          crane tag  "${DST}:${APP_VER}" "latest"
-          docker tag "${SRC}" "${DST}:latest"
-          docker push "${DST}:${APP_VER}"
-          docker push "${DST}:${CHART_TAG}"
-          docker push "${DST}:latest"
           echo "Mirrored ${SRC} → ${DST}:{${APP_VER},${CHART_TAG},latest}"
 
       - name: Create tag