build(docker): bake org.opencontainers.image.source into the image

The canonical, build-tool-independent way GHCR links a container package
to its repo is a Dockerfile LABEL baked into the image config — not
buildx/metadata-action annotations. Add it so freshly-created packages
auto-connect.

Note: GHCR evaluates the source at package CREATION, so this links new
packages; an already-orphaned package needs a one-time manual connect
(or delete + re-publish) regardless.

Type build → no version bump.

Dockerfile

@@ -30,6 +30,12 @@ RUN pnpm --filter @openconcho/web build
 # under a read-only filesystem with cap_drop ALL.
 FROM nginxinc/nginx-unprivileged:alpine
 
+# Baked into the image config — the canonical, build-tool-independent signal GHCR
+# reads to connect the published package to this repo. Evaluated at package
+# creation, so it links freshly-created packages without relying on buildx
+# annotation levels.
+LABEL org.opencontainers.image.source="https://github.com/offendingcommit/openconcho"
+
 COPY --chown=101:101 --from=builder /app/packages/web/dist /usr/share/nginx/html
 # Rendered to /etc/nginx/conf.d/default.conf by the image's envsubst entrypoint.
 COPY --chown=101:101 docker/nginx.conf.template /etc/nginx/templates/default.conf.template