GHCR defaults new packages to private, so docker pull
ghcr.io/rightnow-ai/openfang:... returned 401 for unauthenticated
users despite the repo being public.
Two changes to the docker job in release.yml:
1. Add OCI labels to the build — links the package to the repo so
GHCR associates it correctly, and is standard practice for
container images.
2. After each push, call the GitHub Packages API (PATCH
/orgs/RightNow-AI/packages/container/openfang) to set visibility
to public. The workflow already holds packages: write, which is
the required scope. This runs on every release tag so visibility
cannot regress if the package is ever reset.
Fixes#961