ci: fix release-id extraction (greedy sed grabbed the wrong id) + re-run safety

The job log showed uploads 404ing: sed's greedy .* matched the LAST "id"
in the release JSON (a nested user id), not the release's. First-match
grep now. Release creation falls back to GET-by-tag on re-runs, and the
image job strips any scheme from the internal server URL (http://app:3000)
with an ECHOLOT_REGISTRY_HOST override for the public registry host.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/build-server.yml

@@ -44,11 +44,16 @@ jobs:
           TOKEN: ${{ secrets.GITHUB_TOKEN }}
           API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
         run: |
-          REL=$(curl -sf -X POST "$API/releases" \
+          # Create the release; if it already exists (re-run), fetch it by tag.
+          if ! REL=$(curl -sf -X POST "$API/releases" \
             -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
-            -d "{\"tag_name\":\"$GITHUB_REF_NAME\",\"name\":\"$GITHUB_REF_NAME\"}")
-          # jq-free id extraction — keep runner image requirements minimal
-          ID=$(echo "$REL" | sed -n 's/.*"id":\([0-9]*\).*/\1/p' | head -1)
+            -d "{\"tag_name\":\"$GITHUB_REF_NAME\",\"name\":\"$GITHUB_REF_NAME\"}"); then
+            REL=$(curl -sf "$API/releases/tags/$GITHUB_REF_NAME" -H "Authorization: token $TOKEN")
+          fi
+          # jq-free id extraction. grep -o, NOT greedy sed: a greedy leading .*
+          # matches the LAST "id" in the payload (a nested user/repo id) and
+          # the uploads 404 — that broke the first v0.1.0 release run.
+          ID=$(echo "$REL" | grep -o '"id":[0-9]*' | head -1 | cut -d: -f2)
           for f in dist/*; do
             curl -sf -X POST "$API/releases/$ID/assets?name=$(basename "$f")" \
               -H "Authorization: token $TOKEN" -F "attachment=@$f"
@@ -63,7 +68,10 @@ jobs:
         id: meta
         run: |
           echo "version=${GITHUB_REF_NAME#server-}" >> "$GITHUB_OUTPUT"
-          HOST="${GITHUB_SERVER_URL#https://}"
+          # GITHUB_SERVER_URL inside the runner is the INTERNAL url
+          # (http://app:3000) — strip any scheme, and prefer the public host
+          # for the registry so pulled image references work outside.
+          HOST="${ECHOLOT_REGISTRY_HOST:-${GITHUB_SERVER_URL#*://}}"
           echo "host=$HOST" >> "$GITHUB_OUTPUT"
           echo "image=$HOST/${GITHUB_REPOSITORY,,}-server" >> "$GITHUB_OUTPUT"