ci: drop sencho-mesh sidecar publish job (#1011)

The shared sencho_mesh Docker network replaced host-mode mesh, so the
sidecar image is no longer built or distributed. Remove the obsolete
push_mesh_sidecar job from the release workflow.

.github/workflows/docker-publish.yml

@@ -259,92 +259,3 @@ jobs:
             sbom.cdx.json
             sbom.spdx.json
             security/vex/sencho.openvex.json
-
-  push_mesh_sidecar:
-    name: Push Sencho Mesh sidecar image to Docker Hub and GHCR
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    environment: production
-    permissions:
-      contents: read
-      id-token: write
-      # Required to push the sidecar image to ghcr.io/studio-saelix/sencho-mesh.
-      packages: write
-    steps:
-      - name: Check out the repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
-        with:
-          platforms: arm64
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
-        with:
-          registry: ghcr.io
-          # repository_owner resolves to a fixed value (studio-saelix) on every
-          # event type. github.actor varies (a maintainer on workflow_dispatch,
-          # github-actions[bot] on the release tag push) and is just a label;
-          # GITHUB_TOKEN is what actually authenticates.
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Install cosign
-        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
-
-      - name: Extract metadata for Mesh sidecar image
-        id: mesh_meta
-        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
-        with:
-          # Sencho Mesh sidecar image. Versioned in lockstep with the main
-          # sencho image so each Sencho release has a matched mesh sidecar.
-          # Same registry pair as the main image; tags are identical across
-          # both so users on either registry pull the same content.
-          images: |
-            saelix/sencho-mesh
-            ghcr.io/studio-saelix/sencho-mesh
-          tags: |
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=semver,pattern={{version}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-            type=semver,pattern={{major}}.{{minor}},enable=${{ startsWith(github.ref, 'refs/tags/v') }}
-
-      - name: Build and push Mesh sidecar image
-        id: mesh_build
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
-        with:
-          context: ./mesh-sidecar
-          file: ./mesh-sidecar/Dockerfile
-          push: true
-          platforms: linux/amd64,linux/arm64
-          tags: ${{ steps.mesh_meta.outputs.tags }}
-          labels: ${{ steps.mesh_meta.outputs.labels }}
-          cache-from: type=registry,ref=saelix/sencho-mesh:buildcache
-          cache-to: type=registry,ref=saelix/sencho-mesh:buildcache,mode=max
-          sbom: true
-          provenance: mode=max
-
-      - name: Sign Mesh sidecar with cosign (keyless)
-        env:
-          TAGS: ${{ steps.mesh_meta.outputs.tags }}
-          DIGEST: ${{ steps.mesh_build.outputs.digest }}
-        run: |
-          refs=()
-          while IFS= read -r tag; do
-            [ -n "$tag" ] || continue
-            refs+=("${tag}@${DIGEST}")
-          done <<< "$TAGS"
-          if [ ${#refs[@]} -gt 0 ]; then
-            cosign sign --yes "${refs[@]}"
-          else
-            echo "No tags to sign (likely a workflow_dispatch run on a non-tag ref)."
-          fi