Bump opencode 1.14.44 -> 1.14.50; cut over to split-base pipeline

- Bump OPENCODE_VERSION 1.14.44 -> 1.14.50 in Dockerfile.variant
- Cut over: docker-publish-split.yml now triggers on push: tags: v*
  (was workflow_dispatch only). RELEASE_TAG and PROMOTE_LATEST derived
  from github.ref_type/ref_name for tag-push; inputs still available
  for manual workflow_dispatch runs.
- Delete docker-publish.yml (retired, replaced by split-base pipeline)
- Delete Dockerfile (retired, replaced by Dockerfile.base + Dockerfile.variant)
- Update CHANGELOG: promote Unreleased -> v1.14.50
- Update AGENTS.md, .gitea/README.md, validate.yml: remove all references
  to the old single-Dockerfile pipeline and WIP migration plan

.gitea/workflows/docker-publish-split.yml

@@ -1,13 +1,7 @@
-name: Publish Docker Image (split-base)
+name: Publish Docker Image
 
-# Two-phase split-base build pipeline. Lives ALONGSIDE the original
-# docker-publish.yml during the migration window. Triggers only on
-# workflow_dispatch (manual) so it doesn't conflict with the production
-# tag-trigger pipeline.
-#
-# Once we've validated 1-2 successful runs and verified output
-# byte-for-byte against the original, this workflow takes over `on:
-# push: tags: v*` and the original is retired.
+# Two-phase split-base build pipeline. Replaces the original
+# docker-publish.yml single-Dockerfile pipeline.
 #
 # Pipeline shape:
 #   1. base-decide      compute base hash from Dockerfile.base + rootfs/
@@ -22,14 +16,17 @@ name: Publish Docker Image (split-base)
 #   6. update-description   patch Docker Hub description (unchanged).
 
 on:
+  push:
+    tags:
+      - 'v*'
   workflow_dispatch:
     inputs:
       release_tag:
-        description: 'Release tag to publish (e.g. v1.14.42-split). Pushed to Docker Hub as both the literal tag and `latest*`-aliases.'
-        required: true
-        default: 'v0.0.0-split-test'
+        description: 'Release tag to publish (e.g. v1.14.50). Used only for workflow_dispatch runs — tag-triggered runs derive the tag from github.ref.'
+        required: false
+        default: ''
       promote_latest:
-        description: 'Update latest/latest-omos/latest-with-pi/latest-omos-with-pi aliases (set false for test runs)'
+        description: 'Update latest/* aliases (default true for tag-push, set false for manual test runs)'
         required: false
         default: 'false'
 
@@ -40,6 +37,8 @@ concurrency:
 env:
   BUILDKIT_PROGRESS: plain
   IMAGE: ${{ vars.DOCKERHUB_USERNAME }}/opencode-devbox
+  RELEASE_TAG: ${{ github.ref_type == 'tag' && github.ref_name || inputs.release_tag }}
+  PROMOTE_LATEST: ${{ github.ref_type == 'tag' && 'true' || inputs.promote_latest }}
 
 # ───────────────────────────────────────────────────────────────────
 # Reusable disk-reclaim snippet — strips catthehacker toolchains and
@@ -354,10 +353,10 @@ jobs:
       - name: Compute version-specific tags
         id: tags
         run: |
-          VERSION="${{ inputs.release_tag }}"
+          VERSION="${{ env.RELEASE_TAG }}"
           { echo "tags<<EOF"
             echo "${IMAGE}:${VERSION}"
-            if [ "${{ inputs.promote_latest }}" = "true" ]; then
+            if [ "${{ env.PROMOTE_LATEST }}" = "true" ]; then
               echo "${IMAGE}:latest"
             fi
             echo "EOF"
@@ -402,10 +401,10 @@ jobs:
       - name: Compute version-specific tags
         id: tags
         run: |
-          VERSION="${{ inputs.release_tag }}"
+          VERSION="${{ env.RELEASE_TAG }}"
           { echo "tags<<EOF"
             echo "${IMAGE}:${VERSION}-omos"
-            if [ "${{ inputs.promote_latest }}" = "true" ]; then
+            if [ "${{ env.PROMOTE_LATEST }}" = "true" ]; then
               echo "${IMAGE}:latest-omos"
             fi
             echo "EOF"
@@ -450,10 +449,10 @@ jobs:
       - name: Compute version-specific tags
         id: tags
         run: |
-          VERSION="${{ inputs.release_tag }}"
+          VERSION="${{ env.RELEASE_TAG }}"
           { echo "tags<<EOF"
             echo "${IMAGE}:${VERSION}-with-pi"
-            if [ "${{ inputs.promote_latest }}" = "true" ]; then
+            if [ "${{ env.PROMOTE_LATEST }}" = "true" ]; then
               echo "${IMAGE}:latest-with-pi"
             fi
             echo "EOF"
@@ -498,10 +497,10 @@ jobs:
       - name: Compute version-specific tags
         id: tags
         run: |
-          VERSION="${{ inputs.release_tag }}"
+          VERSION="${{ env.RELEASE_TAG }}"
           { echo "tags<<EOF"
             echo "${IMAGE}:${VERSION}-omos-with-pi"
-            if [ "${{ inputs.promote_latest }}" = "true" ]; then
+            if [ "${{ env.PROMOTE_LATEST }}" = "true" ]; then
               echo "${IMAGE}:latest-omos-with-pi"
             fi
             echo "EOF"
@@ -527,7 +526,7 @@ jobs:
       - build-variant-omos
       - build-variant-with-pi
       - build-variant-omos-with-pi
-    if: inputs.promote_latest == 'true'
+    if: env.PROMOTE_LATEST == 'true'
     runs-on: ubuntu-latest
     container:
       image: catthehacker/ubuntu:act-latest
@@ -551,7 +550,7 @@ jobs:
       - build-variant-omos
       - build-variant-with-pi
       - build-variant-omos-with-pi
-    if: inputs.promote_latest == 'true'
+    if: env.PROMOTE_LATEST == 'true'
     runs-on: ubuntu-latest
     container:
       image: catthehacker/ubuntu:act-latest