ci: GitLab-Pipeline - build_embedded + manueller npm-Publish nach rohana (threadnet-call#1)

Registry-Entscheidung evidenzbasiert: das Package ist pnpm-Dependency von
ThreadNet-Webs apps/web, der Lockfile pinnt die Tarball-URL auf rohana -
Registry bleibt dort. Publish-Auth ueber CI-Variable GITEA_NPM_TOKEN statt
lokaler Klartext-.npmrc.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/publish.yaml

@@ -0,0 +1,85 @@
+name: Build & publish full packages for releases
+
+on:
+  release:
+    types: [published]
+
+env:
+  VERSION: ${{ github.event.release.tag_name }}
+
+jobs:
+  build_element_call:
+    uses: ./.github/workflows/build-element-call.yaml
+    with:
+      package: full
+      vite_app_version: ${{ github.event.release.tag_name }} # Using ${{ env.VERSION }} here doesn't work
+    secrets:
+      SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
+      SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
+      SENTRY_URL: ${{ secrets.SENTRY_URL }}
+      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+
+  publish_tarball:
+    needs: build_element_call
+    if: always()
+    name: Publish tarball
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # required to upload release asset
+      packages: write
+    steps:
+      - name: Determine filename
+        run: echo "FILENAME_PREFIX=element-call-${VERSION:1}" >> "$GITHUB_ENV"
+      - name: 📥 Download built element-call artifact
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id || github.run_id }}
+          name: build-output-full
+          path: ${{ env.FILENAME_PREFIX }}
+      - name: Create Tarball
+        run: tar --numeric-owner --transform "s/dist/${FILENAME_PREFIX}/" -cvzf ${FILENAME_PREFIX}.tar.gz ${FILENAME_PREFIX}
+      - name: Create Checksum
+        run: find ${FILENAME_PREFIX} -type f -print0 | sort -z | xargs -0 sha256sum | tee ${FILENAME_PREFIX}.sha256
+      - name: Upload
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        with:
+          files: |
+            ${{ env.FILENAME_PREFIX }}.tar.gz
+            ${{ env.FILENAME_PREFIX }}.sha256
+
+  publish_docker:
+    needs: build_element_call
+    if: always()
+    name: Publish docker
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/build-and-publish-docker.yaml
+    secrets: inherit
+    with:
+      artifact_run_id: ${{ github.event.workflow_run.id || github.run_id }}
+      docker_tags: |
+        type=sha,format=short,event=branch
+        type=raw,value=${{ github.event.release.tag_name }}
+        type=raw,value=latest
+      # Like before, using ${{ env.VERSION }} above doesn't work
+  add_docker_release_note:
+    needs: publish_docker
+    name: Add docker release note
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add release note
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        with:
+          append_body: true
+          body: |
+            ## Docker full package
+            Element Call is available as a Docker image from the [GitHub Container Registry](https://github.com/element-hq/element-call/pkgs/container/element-call).
+
+            The image provides a full build of Element Call that can be used both in standalone and as a widget (on a remote URL).
+
+            ```
+            docker pull ghcr.io/element-hq/element-call:${{ env.VERSION }}
+            ```