fix: normalize branch names into valid image tags

A branch such as feature/foo produced an invalid Docker tag, so the build
aborted before it started. Replace invalid characters with a dash, strip
leading dots and dashes, and cap the length at 128. master still maps to
latest.

The branch name now reaches the shell through an env var, because a name
containing $(...) was previously executed by the step.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -17,8 +17,14 @@ jobs:
       - name: get registry from current GITHUB_SERVER_URL
         run: echo "REGISTRY=${GITHUB_SERVER_URL//https:\/\//}" >> $GITHUB_ENV
 
+      # Docker tags allow [A-Za-z0-9_.-], up to 128 chars, no leading dot or dash.
+      # The branch name stays in an env var so it is never parsed as shell code.
       - name: build image reference
-        run: echo "IMAGE_URL=${{ env.REGISTRY }}/${GITHUB_REPOSITORY,,}:${{ env.IMAGE_TAG }}" >> $GITHUB_ENV
+        env:
+          RAW_TAG: ${{ env.IMAGE_TAG }}
+        run: |
+          TAG=$(printf '%s' "$RAW_TAG" | tr -c 'A-Za-z0-9_.-' '-' | sed 's/^[.-]*//' | cut -c1-128)
+          echo "IMAGE_URL=${{ env.REGISTRY }}/${GITHUB_REPOSITORY,,}:${TAG}" >> $GITHUB_ENV
 
       - name: Check out repository code
         uses: https://gitea.com/actions/checkout@v3