ci: the image build waits on the integration lane (rule 177, #4958)

The integration job was added after the build gate (c6211e5) and never
joined its needs, so main run 8212 published :latest with integration red.
Both jobs carry the same ref condition, so the gate cannot be satisfied by
a skipped integration run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -328,7 +328,13 @@ jobs:
     # wouldn't un-publish a bad hook anyway: the push already did that. A failed
     # `plugin` job still turns the whole run red, which is the signal that
     # matters.
-    needs: [typecheck, lint, test]
+    #
+    # `integration` IS in needs (rule 177, #4958). It was added after this
+    # gate and left out of it, so on 2026-10-05 main run 8212 published
+    # :latest with integration red. The image carries the migrations and the
+    # queries that lane runs against real Postgres; a red integration run is
+    # a red image.
+    needs: [typecheck, lint, test, integration]
     # Build on dev, main, and v* tag pushes. dev → :dev, main → :latest,
     # tag → :latest + :<version>; every build also gets an immutable :<sha>.
     if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')