ci: enforce GHCR package visibility public after each push

GHCR packages default private on first creation. Add a best-effort
gh api PATCH call at the end of both the multi-arch merge job and the
cpu build job so any new package version is immediately public without
requiring a manual UI step.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/docker-publish.yml

@@ -131,6 +131,13 @@ jobs:
         run: |
           docker buildx imagetools inspect ${{ steps.tags.outputs.tags }}
 
+      - name: Ensure package is public
+        run: |
+          gh api -X PATCH /user/packages/container/winnow \
+            -f visibility=public || true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   build-cpu:
     name: Build CPU-only (amd64)
     runs-on: ubuntu-latest
@@ -185,3 +192,10 @@ jobs:
       - name: Inspect CPU image
         run: |
           docker buildx imagetools inspect ${{ steps.cpu-tag.outputs.tag }}
+
+      - name: Ensure package is public
+        run: |
+          gh api -X PATCH /user/packages/container/winnow \
+            -f visibility=public || true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}