Gitea reads .gitea/workflows in preference to .github/workflows, so this
supersedes the ghcr.io workflow here without deleting it: that one stays
correct for github.com, and the two cannot race.
Registry cache rather than type=gha -- a self-hosted act_runner supplies
ACTIONS_CACHE_URL/ACTIONS_RUNTIME_TOKEN inconsistently, and without a
cache every run recompiles the openvpn3 core from scratch. Attestations
are off because they turn the push into a multi-manifest index that
Gitea's package view renders as junk entries.
