Fix CI: use crane to mirror image (no Docker daemon in runner)

The Gitea Actions runner container lacks Docker. Use crane
(daemonless) to copy the upstream FleetDM image directly to
the Gitea OCI registry.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/release.yaml

@@ -123,19 +123,19 @@ jobs:
 
       - name: Mirror FleetDM image to Gitea registry
         run: |
+          CRANE_VER="v0.20.3"
+          curl -fsSL "https://github.com/google/go-containerregistry/releases/download/${CRANE_VER}/go-containerregistry_Linux_x86_64.tar.gz" \
+            | tar -xz -C /usr/local/bin crane
+
           APP_VER=$(grep '^appVersion:' fleetdm-stack/Chart.yaml | awk '{print $2}' | tr -d '"')
           CHART_TAG="${{ steps.version.outputs.new_tag }}"
-          SRC="fleetdm/fleet:v${APP_VER}"
+          SRC="docker.io/fleetdm/fleet:v${APP_VER}"
           DST="git.produktor.io/${{ gitea.repository }}/fleet"
 
-          echo "${{ gitea.token }}" | docker login git.produktor.io -u "${{ gitea.actor }}" --password-stdin
-          docker pull "${SRC}"
-          docker tag "${SRC}" "${DST}:${APP_VER}"
-          docker tag "${SRC}" "${DST}:${CHART_TAG}"
-          docker tag "${SRC}" "${DST}:latest"
-          docker push "${DST}:${APP_VER}"
-          docker push "${DST}:${CHART_TAG}"
-          docker push "${DST}:latest"
+          crane auth login git.produktor.io -u "${{ gitea.actor }}" -p "${{ gitea.token }}"
+          crane copy "${SRC}" "${DST}:${APP_VER}"
+          crane tag  "${DST}:${APP_VER}" "${CHART_TAG}"
+          crane tag  "${DST}:${APP_VER}" "latest"
           echo "Mirrored ${SRC} → ${DST}:{${APP_VER},${CHART_TAG},latest}"
 
       - name: Create tag