Use runner-native artifact upload action

.gitea/workflows/backend-quality-gate.yml

@@ -244,8 +244,6 @@ jobs:
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
           set -euo pipefail
-          cleanup() { docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true; }
-          trap cleanup EXIT
           printf '%s' "$REGISTRY_PASSWORD" | docker login "$REGISTRY_HOST" --username "$REGISTRY_USERNAME" --password-stdin
           docker build -f deploy/railway-api.Dockerfile -t "$IMAGE_REPOSITORY:api-$GITEA_SHA" .
           docker build -f deploy/railway-web.Dockerfile -t "$IMAGE_REPOSITORY:web-$GITEA_SHA" .
@@ -271,9 +269,13 @@ jobs:
             artifacts/staging-images/manifest.env "$GITEA_SHA" "$IMAGE_REPOSITORY" >/dev/null
 
       - name: Upload immutable staging image manifest
-        uses: https://gitea.com/actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4
         with:
           name: staging-image-manifest-${{ gitea.sha }}-${{ gitea.run_attempt }}
           path: artifacts/staging-images/manifest.env
           if-no-files-found: error
           retention-days: 30
+
+      - name: Logout ACR registry
+        if: always()
+        run: docker logout "$REGISTRY_HOST" >/dev/null 2>&1 || true

frontend/tests/staging-backend-workflows.test.ts

@@ -201,8 +201,15 @@ test("Gitea quality gate validates before publishing an immutable ACR manifest",
   assert.match(workflow, /get\("os"\)=="linux"/);
   assert.match(workflow, /get\("architecture"\)=="amd64"/);
   assert.match(workflow, /node frontend\/scripts\/staging-image-manifest\.mjs/);
-  assert.match(workflow, /uses: https:\/\/gitea\.com\/actions\/upload-artifact@v4/);
+  assert.match(workflow, /uses: actions\/upload-artifact@v4/);
   assert.match(workflow, /name: staging-image-manifest-\$\{\{ gitea\.sha \}\}-\$\{\{ gitea\.run_attempt \}\}/);
+  assertOrder(workflow, [
+    "docker login",
+    "Record immutable linux-amd64 image manifest",
+    "Upload immutable staging image manifest",
+    "Logout ACR registry",
+  ]);
+  assert.match(workflow, /Logout ACR registry\n\s+if: always\(\)/);
   assert.match(workflow, /\[\[ "\$GITEA_RUN_ATTEMPT" =~ \^\[0-9\]\+\$ \]\]/);
   assert.doesNotMatch(workflow, /STAGING_SSH_PRIVATE_KEY|run-staging-deploy\.sh|curl[^\n]+STAGING_URL/);
   assert.doesNotMatch(workflow, /(?:^|:)latest$/m);