ci: add community release workflow

TASKS.md

@@ -172,3 +172,28 @@ Progress:
   - Phase 3 dependency slice: added `CacheBackendFactory` in `crank-runtime` with `BuiltinCacheBackendFactory`; unlike the original draft, the seam lives in runtime rather than core to avoid a `crank-core -> crank-runtime` dependency cycle around `RuntimeCacheStores`
   - Phase 5 / task `5.1`: added Community UI overlay foundation — `slot-registry.js`, `overlay-loader.js`, optional `CRANK_UI_OVERLAY_DIR` copy path in the UI build, settings slot mounts, and wizard protocol-card slot mounts; Community build stays noop without any private overlay package
   - backward-compatible alias `CommunityMachineCredentialVerifier` сохранен, поведение Community не изменено
+
+### `feat/community-release-pipeline`
+
+Status: in_progress
+
+Goal:
+- закрыть `Phase 6.1` и сделать reproducible tag-release flow для `crank-community`.
+
+Main code areas:
+- `.github/workflows/release.yml`
+- `apps/admin-api/Dockerfile`
+- `apps/mcp-server/Dockerfile`
+- `apps/ui/Dockerfile`
+
+Implementation slices:
+1. build release binaries and UI dist on `push tag v*`;
+2. publish Community images to `GHCR`;
+3. attach checksums and SBOM to GitHub Release.
+
+DoD:
+- `crank-community` выпускается из собственного repo без private inputs;
+- tag push `v*` produces GitHub Release artifacts and container images.
+
+Verification:
+- `python3` YAML parse for `.github/workflows/release.yml`