fix: use Podman instead of non-existent Kaniko binary (#223)

Kaniko doesn't provide standalone binary downloads - it's distributed as a
container image. The download URL returns 404.

Solution: Use Podman which:
- Available as standard apt package
- Runs rootless without daemon
- Works on unprivileged runners
- Docker-compatible CLI

This avoids both the Docker namespace issue and the missing Kaniko binary.

Reviewed-on: graham/towerops-web#223

.forgejo/workflows/production.yaml

@@ -100,28 +100,31 @@ jobs:
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
           echo "Full image tag: ${TAG}"
 
-      - name: Install Kaniko
+      - name: Install Podman
         run: |
-          curl -fsSL https://github.com/GoogleContainerTools/kaniko/releases/latest/download/executor-linux-amd64 \
-            -o /usr/local/bin/kaniko
-          chmod +x /usr/local/bin/kaniko
+          sudo apt-get update
+          sudo apt-get install -y podman
 
-      - name: Build and push with Kaniko
+      - name: Build and push with Podman
         run: |
           IMAGE_TAG="${{ steps.tag.outputs.tag }}"
-          REGISTRY_AUTH=$(echo -n "${{ secrets.REGISTRY_USER }}:${{ secrets.REGISTRY_PASSWORD }}" | base64 -w 0)
 
-          mkdir -p /tmp/kaniko-docker
-          echo "{\"auths\":{\"${{ secrets.REGISTRY_URL }}\":{\"auth\":\"${REGISTRY_AUTH}\"}}}" \
-            > /tmp/kaniko-docker/config.json
+          # Build image with Podman (rootless, works on unprivileged runners)
+          podman build \
+            --build-arg MIX_ENV=prod \
+            --file k8s/Dockerfile \
+            --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \
+            --tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production" \
+            .
 
-          /usr/local/bin/kaniko \
-            --context="${GITHUB_WORKSPACE}" \
-            --dockerfile="${GITHUB_WORKSPACE}/k8s/Dockerfile" \
-            --build-arg="MIX_ENV=prod" \
-            --docker-config=/tmp/kaniko-docker \
-            --destination="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}" \
-            --destination="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
+          # Login and push both tags
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | podman login \
+            --username "${{ secrets.REGISTRY_USER }}" \
+            --password-stdin \
+            "${{ secrets.REGISTRY_URL }}"
+
+          podman push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${IMAGE_TAG}"
+          podman push "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:production"
 
   update-manifest:
     name: Update Deployment Manifest