Add make publish: build the image on the Docker host and push it to the registry

`script/publish` runs `script/docker` against the Docker host and pushes the image to the registry under four tags: the UTC date, the short commit hash, the branch name and `latest`. It refuses a working tree with uncommitted changes, since the hash tag names a commit.

Also carries sneak's `golines -m 77` line wrapping in three files, with no code change.

Unverified: a real build on the Docker host and a real push from this commit.
Deviation: sneak's FIXME comments are out, because the linter refuses them; they are #227, #228 and #229.

Model: opus-5-5
Co-authored-by: sneak <sneak@sneak.berlin>

README.md

@@ -68,8 +68,9 @@ Not built, and not planned:
 
 ### The image
 
-No image is published. Build it from a clone. `make docker` runs the tests and
-the linter, then builds the image, tagged `smallwebwaf`.
+The image is published at `git.eeqj.de/sneak/smallwebwaf`. You can also build it
+from a clone. `make docker` runs the tests and the linter, then builds the
+image, tagged `smallwebwaf`.
 
 ```sh
 git clone https://git.eeqj.de/sneak/smallwebwaf.git
@@ -665,6 +666,15 @@ on the host.
   `make check`.
 - `script/docker`: builds the image, whose build runs the tests and the linter
   first. `make docker`.
+- `script/publish`: runs `script/docker`, whose build happens on the Docker host
+  named by `DOCKER_HOST` (`ssh://root@fsn1app1` unless set). It then pushes the
+  image to `PUBLISH_IMAGE` (`git.eeqj.de/sneak/smallwebwaf` unless set). It
+  refuses a working tree with uncommitted changes. `make publish`. It pushes
+  four tags:
+    - the UTC date as `YYYY-MM-DD`;
+    - the short commit hash;
+    - the branch name;
+    - `latest`.
 - `script/cibuild`: what CI runs: `script/bootstrap`, `script/check`, then the
   image build.
 - `script/precommit`: run by the git pre-commit hook; runs `script/check`.