feat: switch to public GitHub kmsvc-proto dependency and GHCR image builds

Forgejo registry unreachable from cluster nodes (WireGuard overlay vs LAN
network isolation, plus host-to-ClusterIP routing gaps). Move to public
GitHub dependency and GHCR image hosting to remove the private-network
dependency entirely.

Dockerfile

@@ -1,10 +1,5 @@
 FROM golang:1.26 AS build
 WORKDIR /src
-ENV GOPRIVATE=forgejo.riotpiao.homelab.com
-# forgejo.riotpiao.homelab.com's cert is signed by a homelab-private CA, not
-# a public one -- without this, `go mod download` can't fetch kmsvc-proto.
-COPY hack/homelab-ca.pem /usr/local/share/ca-certificates/homelab-ca.crt
-RUN update-ca-certificates
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .