Releases: tag each healthy deploy vMAJOR.MINOR.PATCH; /health and node checkin report versions (node-26#49)

VERSION holds MAJOR.MINOR (1.1). The build job works out the next patch
(scripts/next-version.sh, integer count) and stamps it into c2-core as
DRB_VERSION, which /health returns. The new "Tag release" job tags the
commit only after the deploy job succeeds, so a failed deploy's number is
reused. Node checkins carry `version`, stored on the node doc.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -12,9 +12,27 @@ jobs:
   build:
     name: Build & push images
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # node-26#49: this build's release, vMAJOR.MINOR.PATCH. Tagged only once
+      # the deploy is healthy (job "tag" below), so a failed deploy's number is
+      # reused by the next push.
+      - name: Work out the release version
+        id: version
+        run: |
+          git fetch --force --tags origin
+          TAG="$(bash scripts/next-version.sh)"
+          if [ -z "$TAG" ]; then
+            TAG="$(git tag --points-at HEAD | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sort -t. -k3,3n | tail -1)"
+          fi
+          echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
+          echo "release ${TAG}"
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -33,6 +51,7 @@ jobs:
           push: true
           build-args: |
             GIT_SHA=${{ gitea.sha }}
+            DRB_VERSION=${{ steps.version.outputs.version }}
           tags: |
             ${{ env.REGISTRY }}/c2-core:latest
             ${{ env.REGISTRY }}/c2-core:${{ gitea.sha }}
@@ -459,3 +478,26 @@ jobs:
           PY
           curl -sS -X POST -H "Content-Type: application/json" \
             --data @/tmp/payload.json "$WEBHOOK" || echo "notification POST failed"
+
+  # node-26#49: a healthy deploy is a release. Tag it vMAJOR.MINOR.PATCH with
+  # the number the build stamped into /health.
+  tag:
+    name: Tag release
+    needs: [build, deploy]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Tag this commit
+        env:
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "no release version from build ('$VERSION')"; exit 1; }
+          git fetch --force --tags origin
+          if git rev-parse -q --verify "refs/tags/v$VERSION" >/dev/null; then
+            echo "v$VERSION already exists"; exit 0
+          fi
+          git tag "v$VERSION"
+          git push origin "refs/tags/v$VERSION"
+          echo "released v$VERSION"