Tag the image with the commit built, not the one the run started on [skip ci]

After Merge upstream, $GITHUB_SHA is still the pre-merge commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -76,7 +76,10 @@ jobs:
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           printf %s "$REGISTRY_TOKEN" | podman login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
-          for t in "$TAG" "$TAG-$(date -u +%Y%m%d)" "${GITHUB_SHA::12}"; do
+          # The commit built, not $GITHUB_SHA: after "Merge upstream" that's
+          # the merge, not the commit the run started from.
+          built=$(git rev-parse HEAD)
+          for t in "$TAG" "$TAG-$(date -u +%Y%m%d)" "${built::12}"; do
             podman tag "localhost/aurora:$TAG" "$IMAGE:$t"
             podman push --retry 5 "$IMAGE:$t"
           done