Publish verified Docker images to GHCR

Make deployments pull immutable CI-built images while keeping test failures diagnosable before any package is published.

src/test/kotlin/com/osglab/account/config/DeploymentConsistencyTest.kt

@@ -24,6 +24,8 @@ class DeploymentConsistencyTest : FunSpec({
         val compose = root.read("compose.yaml")
 
         compose shouldContain "127.0.0.1:\${ACCOUNT_BIND_PORT:-18080}:8080"
+        compose shouldContain "ghcr.io/hkgood/osg-account-server"
+        compose shouldContain "pull_policy: always"
         compose shouldContain "external: true"
         compose shouldContain "account-egress:"
         compose shouldContain "user: \"10001:10001\""
@@ -63,6 +65,8 @@ class DeploymentConsistencyTest : FunSpec({
         ci shouldContain "docker compose -f compose.yaml config --quiet"
         ci shouldContain "./gradlew --no-daemon clean test"
         ci shouldContain "./gradlew --no-daemon buildFatJar"
+        ci shouldContain "docker/build-push-action@v6"
+        ci shouldContain "packages: write"
         ci shouldNotContain "3306:3306"
         ci shouldNotContain "TEST_DB_"
     }
@@ -91,11 +95,6 @@ private val EXPECTED_PUBLIC_PATHS = setOf(
     "/v1/credits/balance",
     "/v1/credits/ledger",
     "/v1/credits/rates",
-    "/v1/credits/reservations",
-    "/v1/credits/reservations/{reservationId}",
-    "/v1/credits/reservations/{reservationId}/settle",
-    "/v1/credits/reservations/{reservationId}/release",
-    "/v1/credits/reservations/{reservationId}/refund",
     "/v1/referrals",
     "/v1/referrals/me",
     "/v1/referrals/code",