ref(build): release Docker image to GHCR via Craft

[aldy505]

This is an ongoing effort to simplify the release process to not rely on the hacky GitHub Actions script that copies the Docker image after a release was created.

Part of getsentry/self-hosted#4123

REF SELF-78

[getsantry]

This pull request has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you add the label WIP, I will leave it alone unless WIP is removed ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[aldy505]

Can I get some help here? @BYK @hubertdeng123

[BYK]

Related: #106005

[getsantry]

This issue has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you remove the label Waiting for: Community, I will leave it alone ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[aldy505]

This is so annoying for outside contributors.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Missing sourceFormat may prevent finding SHA-tagged source image

High Severity

The old workflow sourced Docker images via commit SHA (ghcr.io/getsentry/sentry:${{ github.sha }}), and the build pipeline in self-hosted.yml only creates images tagged with the commit SHA and nightly — no version-tagged image exists. The new docker targets in .craft.yml omit sourceFormat, so Craft will likely use its default (e.g., {{{source}}}:{{{version}}}), which would look for a version-tagged image like ghcr.io/getsentry/sentry:25.3.0 that doesn't exist in the registry. This could cause the Docker publish step to fail at release time.