Delete the legacy rebuild workflows and their vestigial version-bump script

[jsokol]

Description

Removes the legacy rebuild path now that GA promotes instead of rebuilding. Their stated deletion condition is met: the first post-cutover RC published simplerisk/simplerisk:20260820-001-jammy/-noble, and promote run 32507524464 moved :latest on both images from those digests.

Three commits, deliberately separable:

1. Delete the two entry points — push-to-dockerhub.yml, push-to-gh-pkgs.yml. Already dispatch-only since #160, and unreferenced outside their own files.

2. Delete the two now-orphaned reusable workflows — push-to-dockerhub_rw.yml, push-to-gh-pkgs_rw.yml. Between them they had exactly two callers, both removed in commit 1; nothing else in the repo references either. Split out so you can drop this commit if you'd rather keep the generic build-and-push blocks around.

3. Delete update_workflows.sh — this one is not optional cleanup, it's required. See below.

The trap in commit 3

Deleting the workflows without this would have broken the next release cut. update_workflows.sh does:

for workflow in "$SCRIPT_LOCATION"/.github/workflows/push*; do
  sed -i -r "s/(version:) \"[0-9]{8,}-[0-9]{3,}\"/\1 \"${release}\"/g" "$workflow"
done

With no push* files left, bash leaves the literal glob unexpanded, sed fails on the nonexistent path, and set -e exits 1 — taking down step 1 of make update_version. Verified against the post-deletion tree:

would sed: .github/workflows/push*
^ DOES NOT EXIST -> sed would fail, script exits 1
(exit=1)

The script only ever patched version: pins in those four workflows. Despite its name, simplerisk-minimal/update_stack_and_workflows.sh touches only stack.yml, so nothing else needs it. The version now lives solely in the two generated Dockerfiles (ENV version=) — which is already where promote-latest.yml and create_new_tag.yml read it from.

Removed from three places, because they'd each resurrect it:

• Makefile — the update_version target
• gorin.toml — generates the Makefile, so leaving it would bring the call back on the next make generate_makefile
• CLAUDE.md — the release-step list (also drops the stale "with a fresh random password" note; that script uses a fixed bootstrap password now)

Release Notes

No customer-facing change. Removes dead release plumbing.

Manual Validation Steps

1. make update_version VERSION=20260820-001 → exits 0 (exited 1 before commit 3) and produces no Dockerfile churn.
2. Confirm no remaining workflow carries a version: pin: grep -rn 'version: "' .github/workflows/ → no matches.
3. Confirm the remaining workflow set is container-validation, create_new_tag, promote-latest, publish-testing, shellcheck, verify-image_rw.
4. Next release cut: make update_version then promote-latest dispatch should be the whole image path.

Type of Change

• Build / CI configuration
• Bug fix (prevents a make update_version breakage the deletion would otherwise introduce)

Testing Results

• make update_version VERSION=20260820-001 → exit 0, idempotent, no Dockerfile churn. Proved the pre-fix failure first.
• actionlint clean on every remaining workflow. One pre-existing SC2086:info in create_new_tag.yml — confirmed present on origin/master before this branch; untouched here.
• shellcheck -S error (CI's gate) clean across all tracked scripts.
• No orphan references: grepped the whole tree for both entry points and both _rw files.

CIA Impact Check

WILL NOT negatively impact Confidentiality, Integrity or Availability.

Deletes only workflows that no longer run on any trigger and a script that patches files which no longer exist. The live release path — publish-testing.yml on testing, promote-latest.yml on master — is untouched. Net positive on Availability: it removes a make update_version failure that the deletion would otherwise have introduced into the next release cut.