Design migration of image sources from registry.drycc.cc to ghcr.io and quay.io

[duanhongyi]

Background
Today, image distribution depends primarily on registry.drycc.cc. To improve availability, distribution performance, and ecosystem compatibility, we should move publishing/pulling paths to ghcr.io and quay.io.

Goals

• Support dual publishing targets: ghcr.io + quay.io
• Make new registries the default in deployment configs
• Keep image naming/tag strategy consistent and traceable
• Allow gradual migration with rollback safety

Scope

1. Image naming conventions
   • Standardize org/repo/tag rules
   • Define latest, semver, and commit-SHA tag policy
2. CI/CD publishing flow
   • Build once, push to both GHCR and Quay
   • Retry/failure handling + alerting
   • Optional SBOM/signing compatibility review (e.g., cosign)
3. Deployment config switch
   • Update Helm/manifests/scripts to new image references
   • Support per-environment overrides (dev/staging/prod)
4. Compatibility and rollback
   • Keep old registry path during transition
   • Add fast rollback switch

Definition of Done

• All core images are pullable from GHCR and Quay
• CI supports dual-push with visibility/alerts
• Default deployment no longer depends on registry.drycc.cc as upstream source
• Migration + rollback docs are published
• Staging validation and rollback drill completed

Risks / Notes

• Credentials and permissions (GHCR token, Quay robot account)
• Tag drift/overwrite policy mismatch
• Upstream dependency/rate-limit side effects