ops(deploy): force=true on Coolify webhook + node-26-alpine investigation

C3 — every v1.4.19/20/21 release required a host-side `docker tag`
fallback because Coolify pulled `:latest` from its image cache without
re-checking the GHCR registry digest. The workflow now appends
`?force=true` (or `&force=true` if other params are present) to the
deploy webhook URL so a doc-only push still triggers a registry-digest
check. The complementary maintainer-side toggle ("Watch image registry
for new digests" in the Coolify application config) is documented in
`.planning/coolify-auto-deploy-howto.md` — one checkbox flip in the UI,
no code change required.

C5 — the dependabot PR bumping node:22-alpine → node:26-alpine fails
at build because node:26-alpine no longer ships with corepack
pre-installed (`/bin/sh: corepack: not found`, exit 127). Next.js 16
also still pins node 22 LTS as its supported minimum, so a corepack
workaround would put the runtime ahead of the framework. Closed PR
#162 with a comment; reopen when Next.js bumps its node-version pin.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/docker-publish.yml

@@ -132,10 +132,24 @@ jobs:
             echo "::warning::COOLIFY_WEBHOOK or COOLIFY_TOKEN secret missing — skipping auto-deploy. Configure in repo Settings → Secrets to enable."
             exit 0
           fi
+          # v1.4.22 C3 — force=true tells Coolify to skip its image-cache
+          # and re-pull the registry digest. If the maintainer's secret
+          # URL already carries a `?force=` query, leave it alone;
+          # otherwise append `?force=true` (or `&force=true` if other
+          # query params are present) so doc-only deploys still trigger
+          # a registry-digest check.
+          deploy_url="$COOLIFY_WEBHOOK"
+          if ! echo "$deploy_url" | grep -q "force="; then
+            if echo "$deploy_url" | grep -q "?"; then
+              deploy_url="${deploy_url}&force=true"
+            else
+              deploy_url="${deploy_url}?force=true"
+            fi
+          fi
           echo "Triggering Coolify deploy for ref ${{ github.ref_name }} (sha ${GITHUB_SHA::7})"
           response=$(curl --silent --show-error --max-time 30 \
             --write-out "\n__HTTP_STATUS__:%{http_code}" \
-            --request GET "$COOLIFY_WEBHOOK" \
+            --request GET "$deploy_url" \
             --header "Authorization: Bearer $COOLIFY_TOKEN")
           status="${response##*__HTTP_STATUS__:}"
           body="${response%__HTTP_STATUS__:*}"