fix: Use Gitea API for tag creation instead of git push

git push --tags fails on protected main branch since the runner's
token lacks push permissions. Switch to Gitea REST API call which
bypasses branch protection. Also removes unnecessary VERSION file
commit since CalVer is derived from tags.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/docker-build.yml

@@ -87,17 +87,19 @@ jobs:
           cache-from: type=registry,ref=manticorum67/major-domo-database:buildcache
           cache-to: type=registry,ref=manticorum67/major-domo-database:buildcache,mode=max
 
-      # Create git tag and update VERSION file on successful push
+      # Create git tag via Gitea API (avoids branch protection issues with git push)
       - name: Tag release
         if: success() && github.ref == 'refs/heads/main'
         run: |
-          git config user.name "Gitea Actions"
-          git config user.email "actions@git.manticorum.com"
-          echo "${{ steps.meta.outputs.version }}" > VERSION
-          git add VERSION
-          git commit -m "chore: bump version to ${{ steps.meta.outputs.version }} [skip ci]" || true
-          git tag "${{ steps.meta.outputs.version }}"
-          git push origin main --tags
+          curl -s -X POST \
+            -H "Authorization: token ${{ github.token }}" \
+            -H "Content-Type: application/json" \
+            -d '{
+              "tag_name": "${{ steps.meta.outputs.version }}",
+              "target": "${{ github.sha }}",
+              "message": "Release ${{ steps.meta.outputs.version }}"
+            }' \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/tags"
 
       - name: Build Summary
         run: |