git.vpn.cusano.net is now behind REQUIRE_SIGNIN_VIEW (INCIDENT-2026-09-06), so a fresh Pi can no longer anonymously `docker pull` the node images or fetch install.sh. Plan (owner, option 3): on a `v*` tag, build the three node images (edge-node, icecast, op25-client, arm64) and push them to a PUBLIC registry; source and the private Gitea registry stay walled. This workflow is wired but INERT — the job is gated on `vars.NODE_PUBLIC_PUBLISH == 'true'`, which is unset. It triggers on tags and skips. Enabling is three repo variables + two secrets, documented in the file header; no code change. Reuses the existing Gitea buildcache refs so op25 doesn't recompile from scratch. Not turning it on now — still building the core. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>