ci: GHCR image release workflow (canonical) + README registry model

Add .github/workflows/image.yml: on a version tag, build the collector from source
(deploy/Dockerfile, clean-room) and push to ghcr.io/a3s-lab/observer:<ver>. GHCR is the
canonical/reproducible release; the internal A3S registry (what the egress-constrained
cluster pulls) is fed by promoting/mirroring it. README documents the model.

Author: RoyLin

.github/workflows/image.yml

@@ -0,0 +1,39 @@
+name: image
+
+# Canonical release: on a version tag, build the collector image from source (clean-room,
+# reproducible — unlike a manual host build) and push to GHCR. The internal A3S registry
+# (what the cluster pulls from) is then fed by promoting/mirroring this image.
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }} # -> ghcr.io/a3s-lab/observer (lowercased)
+          tags: |
+            type=semver,pattern={{version}}
+            type=ref,event=tag
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: deploy/Dockerfile # multi-stage: builds the eBPF + collector from source
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

README.md

@@ -136,10 +136,12 @@ OTEL_EXPORTER_OTLP_ENDPOINT=http://otlp-backend:4317 \
 Every event is one valid-JSON line (verified: the `filelog` receiver's `json_parser`
 ingests them directly), so a3s-observer also drops straight into vector / Loki / `jq`.
 
-**Kubernetes:** build the image with [`deploy/Dockerfile`](deploy/Dockerfile) and deploy
-[`deploy/daemonset.yaml`](deploy/daemonset.yaml) (writes NDJSON to stdout); a node-level
-OTel Collector DaemonSet tails the container log. No k8s API/RBAC needed — pod identity
-comes from `/proc/<pid>/cgroup`. This keeps the always-on probe binary minimal and
+**Kubernetes:** CI publishes the image to **`ghcr.io/a3s-lab/observer:<ver>`** on each tag
+([`.github/workflows/image.yml`](.github/workflows/image.yml), built from
+[`deploy/Dockerfile`](deploy/Dockerfile)); mirror/promote it to a cluster-local registry for
+nodes that can't reach `ghcr.io`. Then deploy [`deploy/daemonset.yaml`](deploy/daemonset.yaml)
+(NDJSON to stdout); a node-level OTel Collector DaemonSet tails the container log. No k8s
+API/RBAC needed — pod identity comes from `/proc/<pid>/cgroup`. This keeps the always-on probe binary minimal and
 decoupled from backend availability; in-process OTLP push is intentionally **not** built —
 that's the Collector's job.