docker-release.yml has failed on every release tag since v2026.5.6.1 (tag is needed when pushing to registry)

[webdevtodayjason]

Summary

`.github/workflows/docker-release.yml` has failed every time it has fired since at least v2026.5.6.1. The Docker container images that the workflow is supposed to publish to GHCR (`ghcr.io/ArgentAIOS/argentos-core`) have not been built/pushed in over two weeks.

Failure history (from `gh run list --workflow=docker-release.yml`)

Release	Date	build-amd64	build-arm64
v2026.5.6.6	2026-05-26	failure	failure
v2026.5.6.5 (tag)	2026-05-19	failure	failure
v2026.5.6.5 (main)	2026-05-19	failure	failure
v2026.5.6.4	2026-05-13	failure	failure
v2026.5.6.3	2026-05-13	failure	failure
v2026.5.6.2	2026-05-12	failure	failure
v2026.5.6.1	2026-05-12	failure	failure

Every single run, both architectures, both triggers (tag push + main push).

Error

```
ERROR: failed to build: tag is needed when pushing to registry
##[error]buildx failed with: ERROR: failed to build: tag is needed when pushing to registry
```

This is a docker-buildx error indicating the `tags:` parameter on the `docker/build-push-action` step is empty when push is invoked. Almost always means the `docker/metadata-action` step that's supposed to populate the tag list isn't producing output for whatever ref triggered the run.

Suggested investigation

1. `docker/metadata-action@v5` step likely has `tags:` configuration that doesn't match the actual ref pattern being pushed. Check whether the workflow expects `refs/tags/v*` to match its regex / pattern but the runtime sees something different.
2. Could be that the metadata-action lost `fetch-tags: true` in actions/checkout — without that, the tag isn't in local refs and metadata extraction skips.
3. The deprecation warning about Node.js 20 actions in the run logs is a separate but related concern: actions on `docker/*@v3-v6` are all on Node.js 20 and need bumping by June 2nd, 2026.

Operator-visible impact

Anyone trying to `docker pull ghcr.io/argentaios/argentos-core:2026.5.6.6` (or any release since v2026.5.6.1) will get "manifest unknown" — there's no published image to pull. If we have any Docker-based onboarding flow, it's been broken for the same duration.

Suggested fix

1. Reproduce the failure locally with `act` or in a one-off branch with the same trigger
2. Inspect what `metadata-action` actually emits to `outputs.tags`
3. Likely fix: add explicit `flavor:` and `tags:` config to the metadata-action step, ensure the regex matches `v2026.X.Y.Z` tag format

Discovered during v2026.5.6.6 release on 2026-05-26 when promoting dev → main via PR #430. Not blocking the release itself (main promotion went through), but blocks anyone who wanted to consume our Docker images.

[webdevtodayjason]

Still failing on the v2026.7.7 release (run 28988078994), but the signature has changed — it now dies earlier, in the image build itself:

postinstall: Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/app/src/infra/symlink-sweep.js' imported from /app/scripts/sweep-dashboard-symlinks.ts
Error: Command failed: git rev-parse --show-toplevel  (build-info step — /app is not a git checkout in the Docker context)

Two distinct breaks: (1) the postinstall symlink sweep imports a .js path that doesn't exist in the Docker build context, (2) write-build-info assumes a git worktree. Non-blocking for the tag/hosted-installer rail (v2026.7.7 shipped fine) — but this workflow has now failed on 8+ consecutive releases; either fix the Dockerfile context or disable the workflow until someone owns it.

— noted during the v2026.7.7 release cut