ci(docker): annotate image index so GHCR links the package to the repo

The publish step passed labels but not annotations, so
org.opencontainers.image.source landed only on per-platform configs, not
the multi-arch index. GHCR reads the source from the index annotation to
auto-link a package to its repo, so the package stayed orphaned.

- Set DOCKER_METADATA_ANNOTATIONS_LEVELS=index + pass annotations to the
  build, putting source/url/revision on the index.
- provenance: false keeps the pushed artifact a clean multi-arch index.
- workflow_dispatch now takes a 'tag' input to (re)publish a specific
  version; tags derived from the ref so dispatch and release both work.

Type ci → no version bump; republish v0.13.0 via dispatch.

.github/workflows/docker-publish.yml

@@ -4,6 +4,11 @@ on:
   release:
     types: [published]
   workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing tag to (re)build and publish, e.g. v0.13.0. Defaults to the triggering ref.
+        required: false
+        type: string
 
 permissions:
   contents: read
@@ -15,6 +20,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      # Derive the image version from the tag (release ref or dispatch input) so
+      # raw tags work for both triggers — semver-from-ref doesn't fire on dispatch.
+      - id: ver
+        shell: bash
+        run: |
+          REF="${{ github.event.inputs.tag || github.ref_name }}"
+          V="${REF#v}"
+          echo "version=$V" >> "$GITHUB_OUTPUT"
+          echo "minor=${V%.*}" >> "$GITHUB_OUTPUT"
 
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
@@ -27,11 +44,15 @@ jobs:
 
       - id: meta
         uses: docker/metadata-action@v5
+        # Annotate the INDEX (not just per-platform configs) so GHCR can read
+        # org.opencontainers.image.source and auto-link the package to the repo.
+        env:
+          DOCKER_METADATA_ANNOTATIONS_LEVELS: index
         with:
           images: ghcr.io/${{ github.repository_owner }}/openconcho-web
           tags: |
-            type=semver,pattern={{version}}
+            type=raw,value=${{ steps.ver.outputs.version }}
-            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=${{ steps.ver.outputs.minor }}
             type=raw,value=latest
             type=sha,format=short
 
@@ -40,7 +61,11 @@ jobs:
           context: .
           platforms: linux/amd64,linux/arm64
           push: true
+          # provenance off keeps the pushed artifact a plain multi-arch index,
+          # so the index annotation below is what GHCR sees for repo linking.
+          provenance: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+          annotations: ${{ steps.meta.outputs.annotations }}
           cache-from: type=gha
           cache-to: type=gha,mode=max