release: container images when a release is published; version 0.0.1

.github/workflows/release.yml runs on Gitea and on the GitHub mirror (release: published only)
and pushes selfphoneng-api and selfphoneng-asterisk to that forge's registry: ghcr.io with the
job token, the Gitea registry with secrets REGISTRY_USER + REGISTRY_TOKEN (Gitea's job token
can't push packages). Tags: the version, plus <major>.<minor> and latest unless it's a
pre-release. It stops unless the tag is v + package.json's version, and checks the images
before pushing.

Run locally with act_runner exec against a throwaway registry: v0.0.1 pushed 0.0.1, 0.0 and
latest for both images (VERSION 0.0.1, OCI labels, source archive selfphoneng-0.0.1/);
v9.9.9 failed at the version check.

Version 0.0.1 in all package.json files, CHANGELOG.md started, release steps in 08 §3.1.

Task: none (owner request, 2026-10-20)

CHANGELOG.md

@@ -0,0 +1,22 @@
+# Changelog
+
+Versions follow [semver](https://semver.org). Each release's container images are built from its
+tag (08 §3.1): `selfphoneng-api` and `selfphoneng-asterisk`, on ghcr.io and on the Gitea registry.
+
+## v0.0.1 — 2026-10-20
+
+The first tagged build, for testing. Not for production yet: the v1.0 definition of done
+(docs/spec/09-roadmap.md) still needs a week on a real server with real calls, and the open
+real-account checks.
+
+- Phones, users and extensions; calls between desk phones, softphones and the browser phone.
+- voip.ms trunks (registration or IP auth, UDP/TCP/TLS + SRTP), phone numbers, outbound rules
+  with calling permissions, 911 with E911 caller ID and alerts.
+- Voicemail with email, digital receptionists, office hours, ring groups, queues, parking,
+  pickup, conference rooms, paging and intercom, music on hold.
+- Call history, recordings, the live dashboard (listen, whisper, barge), reports.
+- Desk phone provisioning (Yealink, Grandstream), company phonebook, Linphone setup QR.
+- Security: two-step sign-in for admins, phone network limit, limits on outside calls at once,
+  the M11-T8 security review (08 §6); backups and restore; background watches; webhooks and API
+  tokens; the admin guide.
+- Not in this release: SMS (parked until wanted), `scripts/update.sh` (before v1.0).