feat: automate staging deploy from Windows Gitea runner

Build immutable API and web images in Aliyun ACR after staging validation, then deploy them safely to the staging host.

deploy/run-staging-deploy.sh

@@ -14,7 +14,7 @@ for key in "${required[@]}"; do
 done
 
 sha_pattern='^[0-9a-f]{40}$'
-digest_pattern='^ghcr\.io/jesse-ux/jyotisha-(api|web)@sha256:[0-9a-f]{64}$'
+digest_pattern='^[a-z0-9]([a-z0-9.-]*[a-z0-9])?(:[1-9][0-9]{0,4})?(/[a-z0-9]+([._-][a-z0-9]+)*)+@sha256:[0-9a-f]{64}$'
 image_id_pattern='^sha256:[0-9a-f]{64}$'
 if [[ ! "$DEPLOY_SHA" =~ $sha_pattern ]] ||
   [[ ! "$API_IMAGE" =~ $digest_pattern ]] ||
@@ -22,6 +22,8 @@ if [[ ! "$DEPLOY_SHA" =~ $sha_pattern ]] ||
   echo "unsafe staging image identity" >&2
   exit 1
 fi
+api_repository="${API_IMAGE%@sha256:*}"
+web_repository="${WEB_IMAGE%@sha256:*}"
 if [ "$ALLOW_ROLLBACK" != "true" ] && [ "$ALLOW_ROLLBACK" != "false" ]; then
   echo "invalid rollback authorization" >&2
   exit 1
@@ -85,8 +87,8 @@ repo_digest_for_container() {
     awk -v prefix="$repository@sha256:" 'index($0, prefix) == 1 { print; exit }'
 }
 
-previous_api_image="$(repo_digest_for_container api ghcr.io/jesse-ux/jyotisha-api)"
-previous_web_image="$(repo_digest_for_container web ghcr.io/jesse-ux/jyotisha-web)"
+previous_api_image="$(repo_digest_for_container api "$api_repository")"
+previous_web_image="$(repo_digest_for_container web "$web_repository")"
 previous_api_id=""
 previous_web_id=""
 if [ -n "$(container_id api)" ]; then