Bump opencode 1.14.44 -> 1.14.50; cut over to split-base pipeline

- Bump OPENCODE_VERSION 1.14.44 -> 1.14.50 in Dockerfile.variant
- Cut over: docker-publish-split.yml now triggers on push: tags: v*
  (was workflow_dispatch only). RELEASE_TAG and PROMOTE_LATEST derived
  from github.ref_type/ref_name for tag-push; inputs still available
  for manual workflow_dispatch runs.
- Delete docker-publish.yml (retired, replaced by split-base pipeline)
- Delete Dockerfile (retired, replaced by Dockerfile.base + Dockerfile.variant)
- Update CHANGELOG: promote Unreleased -> v1.14.50
- Update AGENTS.md, .gitea/README.md, validate.yml: remove all references
  to the old single-Dockerfile pipeline and WIP migration plan

.gitea/README.md

@@ -8,11 +8,10 @@ the build pipeline is shaped the way it is, you're in the right place.
 
 | File | Trigger | Role |
 |---|---|---|
-| [`workflows/docker-publish.yml`](workflows/docker-publish.yml) | `push: tags: v*` | **Production release pipeline.** Multi-arch build of all four variants (`base`, `omos`, `with-pi`, `omos-with-pi`), publish to Docker Hub, update Hub description. ~165–180 min wall clock. |
-| [`workflows/docker-publish-split.yml`](workflows/docker-publish-split.yml) | `workflow_dispatch` (manual) | **Experimental split-base pipeline.** Two-phase build: shared `base-<hash>` published once, then four thin variant deltas. Estimated ~30–40 min on cache hit, ~70–90 min when base needs rebuilding. Not yet validated end-to-end; once 1–2 dispatch test runs prove it, this will take over `on: push: tags: v*` and `docker-publish.yml` will be retired. |
+| [`workflows/docker-publish-split.yml`](workflows/docker-publish-split.yml) | `push: tags: v*` | **Production release pipeline.** Two-phase split-base build: shared `base-<hash>` published once (skipped on cache hit), then four parallel variant deltas. ~40–80 min wall clock depending on runner count and whether base needs rebuilding. |
 | [`workflows/validate.yml`](workflows/validate.yml) | `push: branches: main` + PR | **Lightweight gate.** amd64-only smoke test of all four variants + `DOCKER_HUB.md` sync check. ~30 min. Fires on every push to `main`. |
 
-## Why two release pipelines exist
+## Why the split-base pipeline exists
 
 opencode-devbox publishes **four image variants** (`base`, `omos`, `with-pi`, `omos-with-pi`) × **two architectures** (amd64, arm64) = **eight image tags per release**. Today's runners are 2 self-hosted gitea Actions runners. arm64 builds are emulated under QEMU, which is the dominant cost (~3–5x slower than native).
 
@@ -263,26 +262,18 @@ This catches regressions before they reach a tag push. Wall clock ~30 min.
 2. **Run a second dispatch** to confirm cache-hit behavior:
    `base-decide` should set `need_build=false`, `build-base` should be
    skipped entirely, total wall clock should drop to ~25–40 min.
-3. **Cut over.** In a single commit:
-   - Edit `docker-publish-split.yml`: change `on: workflow_dispatch:` to
-     `on: push: tags: v*` and wire `$GITHUB_REF` into the `release_tag`
-     input, set `promote_latest=true` for production runs.
-   - Delete `docker-publish.yml`.
-   - Delete the original `Dockerfile` (keep `Dockerfile.base` +
-     `Dockerfile.variant`).
-   - Update `CHANGELOG.md`: promote the "Build pipeline" Unreleased entry.
-4. **Tag a release.** First production release on the new pipeline. Watch
-   it like a hawk for the first run.
+3. **Cut over** — *done as of v1.14.50.* `docker-publish-split.yml` now
+   triggers on `push: tags: v*`. `docker-publish.yml` and original
+   `Dockerfile` deleted.
+4. **Tag a release.** First production release on the new pipeline.
 
 ## Related docs
 
 - [`AGENTS.md`](../AGENTS.md) — domain facts, release-day checklist,
   documentation coupling rules. Read first when modifying CI behavior.
-- [`CHANGELOG.md`](../CHANGELOG.md) — the build pipeline rewrite is
-  recorded under `Unreleased` until the cutover lands.
-- `Dockerfile`, `Dockerfile.base`, `Dockerfile.variant` — production
-  single-Dockerfile build and the split-base counterparts. Comments at
-  the top of each explain its role.
+- [`CHANGELOG.md`](../CHANGELOG.md) — build pipeline rewrite landed in v1.14.50.
+- `Dockerfile.base`, `Dockerfile.variant` — the split-base Dockerfiles.
+  Comments at the top of each explain their role.
 - [`scripts/smoke-test.sh`](../scripts/smoke-test.sh) — invoked by all
   three workflows; this is the single source of truth for "what does a
   built image have to satisfy".