fix: promote workflow retags staging image instead of rebuilding

Same approach as DocFast — pull :latest (already built by staging CI),
retag with version, deploy. No rebuild = same binary that was tested.

.forgejo/workflows/promote.yml

@@ -6,39 +6,39 @@ on:
 
 jobs:
   promote:
-    name: Promote to Production
+    name: Deploy to Production
     runs-on: ubuntu-latest
+
     steps:
-    - name: Checkout
-      uses: actions/checkout@v4
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+    - name: Install kubectl
+      run: |
+        curl -sLO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
+        chmod +x kubectl
+
     - name: Login to Forgejo Registry
       uses: docker/login-action@v3
       with:
         registry: git.cloonar.com
         username: openclawd
         password: ${{ secrets.REGISTRY_TOKEN }}
-    - name: Build and Push Production
-      uses: docker/build-push-action@v5
-      with:
-        context: .
-        push: true
-        no-cache: true
-        tags: |
-          git.cloonar.com/openclawd/snapapi:prod
+
+    - name: Retag staging image for production
+      run: |
+        # Pull the image that staging already built and tested
+        docker pull --platform linux/arm64 git.cloonar.com/openclawd/snapapi:latest
+        docker tag git.cloonar.com/openclawd/snapapi:latest \
           git.cloonar.com/openclawd/snapapi:${{ github.ref_name }}
-        platforms: linux/arm64
+        docker push git.cloonar.com/openclawd/snapapi:${{ github.ref_name }}
+
     - name: Deploy to Production
       run: |
-        curl -sLO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
-        chmod +x kubectl
         echo "${{ secrets.KUBECONFIG }}" | base64 -d > /tmp/kubeconfig.yaml
+
         ./kubectl set image deployment/snapapi \
           snapapi=git.cloonar.com/openclawd/snapapi:${{ github.ref_name }} \
           -n snapapi --kubeconfig=/tmp/kubeconfig.yaml
+
         ./kubectl rollout status deployment/snapapi \
           -n snapapi --kubeconfig=/tmp/kubeconfig.yaml --timeout=180s
-        echo "✅ Production deploy complete!"
+
+        echo "✅ Production deploy complete! Version: ${{ github.ref_name }}"