deploy: make the GHCR image and chart packages public

[stromanni]

publish-server.yml publishes the Helm chart to oci://ghcr.io/byteveda/charts/flexiq-server since #877, and the step ends with an anonymous readability probe:

if ! DOCKER_CONFIG="$anonymous_docker_config" \
  HELM_REGISTRY_CONFIG="${RUNNER_TEMP}/helm-anonymous.json" \
  helm show chart "${CHART_REGISTRY}/flexiq-server" --version "$VERSION" >/dev/null; then
  echo "::error::Published chart is not anonymously readable. Make the GHCR package public and rerun."

GHCR creates organization packages private, and there is no public default to inherit here — ghcr.io/byteveda/flexiq-server answers UNAUTHORIZED: authentication required to an anonymous probe today, so the existing image package is private too. The chart package does not exist yet: server-v2.0.0 was tagged before the workflow change, so the first helm push happens on the next server release.

That means the next server-vX.Y.Z run publishes the chart, fails its own probe, and stops — after the image, tag, release and proto assets have already gone out. The guard is doing its job, but the fix is a console action nobody can take from CI.

An organization owner needs to set both GHCR packages to public:

• byteveda/flexiq-server (server image) — the helm install/docker pull commands in the chart README and the operator guide assume anonymous pulls today and currently fail for anyone without credentials.
• byteveda/charts/flexiq-server (Helm chart) — only appears after the first helm push, so this one is either a rerun of the failed release job or a flip immediately after the package is created.

Verification, from a machine with no GHCR credentials:

helm show chart oci://ghcr.io/byteveda/charts/flexiq-server --version <released-version>
docker pull ghcr.io/byteveda/flexiq-server:<released-version>

CONTRIBUTING.md records the requirement in the release runbook; this issue tracks actually doing it, and closing the gap between "documented" and "done".

[stromanni]

#883 merged as 94b25209. It adds the preflight probe, so a release now stops before publishing anything instead of half-way through — but it does not clear this issue: ghcr.io/byteveda/flexiq-server still answers unauthorized to an anonymous docker manifest inspect, and the chart package does not exist yet.

Leaving this open for the console action. Until an organization owner flips the packages public, the next server-vX.Y.Z run fails in preflight with:

::error::ghcr.io/byteveda/flexiq-server is not anonymously readable. Make the GHCR package public (see CONTRIBUTING.md) and rerun.

The path and the verification commands are in CONTRIBUTING.md.

[stromanni]

Image package is public. Anonymous docker manifest inspect ghcr.io/byteveda/flexiq-server:latest now returns the OCI index, so the preflight gate added in #883 passes and the README/docs docker pull commands work without credentials.

Worth recording, because the package-level dialog does not explain it: per-package Public and Internal were greyed out with "Setting is disabled by organization administrators". The blocker was the organization package-creation policy, not the package. It is cleared under Organization settings → Packages → Package creation, after which the per-package visibility change becomes selectable.

Leaving this open for the chart half. oci://ghcr.io/byteveda/charts/flexiq-server still answers denied because no helm push has run yet — the package does not exist. It cannot be pre-flipped, so the first server-vX.Y.Z release publishes the chart, fails its own probe once, and needs the visibility change plus a rerun of that job. OCI tags are mutable, so the re-push is a no-op in effect.