Add make publish: build the image on the Docker host and push it to the registry

script/publish runs script/docker with DOCKER_HOST set to the Docker
host (ssh://root@fsn1app1 unless set) and pushes the image to
git.eeqj.de/sneak/smallwebwaf under four tags: the UTC date as
YYYY-MM-DD, the short commit hash, the branch name and latest. It
refuses a working tree with uncommitted changes, since the hash tag
names a commit.

Makefile

@@ -1,5 +1,5 @@
-.PHONY: bootstrap setup test lint fmt fmt-check tidy check docker hooks build \
-	run example-app gitea-requests gitea-setup
+.PHONY: bootstrap setup test lint fmt fmt-check tidy check docker publish \
+	hooks build run example-app gitea-requests gitea-setup
 
 # Makefile targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -7,7 +7,8 @@
 # which test checks. build and run are for working on the code by hand;
 # example-app checks the image with an app built on it; gitea-requests
 # reports the gitea requests the Core Rule Set refuses at the defaults;
-# gitea-setup checks the setup in deploy/gitea.
+# gitea-setup checks the setup in deploy/gitea; publish builds the image
+# on the Docker host and pushes it to the registry.
 
 bootstrap:
 	@script/bootstrap
@@ -36,6 +37,9 @@ check:
 docker:
 	@script/docker
 
+publish:
+	@script/publish
+
 hooks:
 	@script/install-precommit