Ask for org owner: make ghcr.io/odysseus-dev/odysseus public | two-click change, removes the local build on deploy

[Glitch3dPenguin]

TL;DR: PR #6085 does all the code-side work for the missing-public-image regression (#5728 / #6082). The one remaining step is a two-click settings change that only an org owner can make: set the odysseus GHCR package to public and link it to the repo. No code, no new builds, no new moving parts.

Background

Since the pewdiepie-archdaemon → odysseus-dev org rename, there has been no usable public production image:

• The new package ghcr.io/odysseus-dev/odysseus is built on every push to main/dev, but anonymous pulls 403 (package is private/unlinked)
• The old ghcr.io/pewdiepie-archdaemon/odysseus is frozen at a 2026-07-12 build with no signal

So today, deploying through compose (Portainer, Coolify, plain docker compose) means the pull fails and Compose falls back to building the entire app image locally on every deploy/update — even on hosts that don't have a build toolchain installed.

What #6085 does (all of the code side)

• main publishes get an immutable sha-pinned tag X.Y.Z-<sha> in addition to latest/X.Y.Z, so production can pin an exact build that cannot move under them
• Compose files reference ghcr.io/odysseus-dev/odysseus with build: . kept as a fallback, so nothing breaks until the package is public
• README/setup guide document the image and tag scheme

The PR is up to date with dev and fully validated (see the description).

What's left

Packages → odysseus → set visibility to Public + connect the package to odysseus-dev/odysseus. That's it — two clicks.

Why it's worth it

• Deploys go from "clone the repo + build the full image" to "pull a prebuilt multi-arch image." For hosts without a build toolchain, that's the difference between a 2-minute deploy and a 10–20 minute build — or, in some cases, not being able to deploy at all
• The sha-pinned tags in fix(docker): immutable sha-pinned main image tag + registry image with build fallback in compose #6085 actually become anonymously resolvable, which is what makes them a real production guarantee
• No new supply-chain surface: same public repo code, already built by GitHub Actions on every push — making the package public doesn't add any new artifact or process
• The docs in the tree become true (today nothing in the repo mentions the image)

Small optional follow-ups

• A package README on the old ghcr.io/pewdiepie-archdaemon/odysseus pointing at the new name (or deprecate it)
• GitHub Releases per version to pair with the sha-pinned tags (packaging: Shared release foundation and distribution inventory #5629)

[Glitch3dPenguin]

Update: PR #6085 has just been re-synced with dev — it had fallen out of date after #6176 (Pages site source reorganization) landed. The docs additions now live at the new website/setup.md location, the README link follows the move, and the PR is mergeable again. Nothing else about the change is different; the two-click settings step above is still the only remaining item.