Add make publish: build the image on the Docker host and push it to the registry

script/publish runs script/docker with DOCKER_HOST set to the Docker
host (ssh://root@fsn1app1 unless set) and pushes the image to
git.eeqj.de/sneak/smallwebwaf under four tags: the UTC date as
YYYY-MM-DD, the short commit hash, the branch name and latest. It
refuses a working tree with uncommitted changes, since the hash tag
names a commit.

README.md

@@ -68,8 +68,9 @@ Not built, and not planned:
 
 ### The image
 
-No image is published. Build it from a clone. `make docker` runs the tests and
-the linter, then builds the image, tagged `smallwebwaf`.
+The image is published at `git.eeqj.de/sneak/smallwebwaf`. You can also build it
+from a clone. `make docker` runs the tests and the linter, then builds the
+image, tagged `smallwebwaf`.
 
 ```sh
 git clone https://git.eeqj.de/sneak/smallwebwaf.git
@@ -665,6 +666,15 @@ on the host.
   `make check`.
 - `script/docker`: builds the image, whose build runs the tests and the linter
   first. `make docker`.
+- `script/publish`: runs `script/docker`, whose build happens on the Docker host
+  named by `DOCKER_HOST` (`ssh://root@fsn1app1` unless set). It then pushes the
+  image to `PUBLISH_IMAGE` (`git.eeqj.de/sneak/smallwebwaf` unless set). It
+  refuses a working tree with uncommitted changes. `make publish`. It pushes
+  four tags:
+    - the UTC date as `YYYY-MM-DD`;
+    - the short commit hash;
+    - the branch name;
+    - `latest`.
 - `script/cibuild`: what CI runs: `script/bootstrap`, `script/check`, then the
   image build.
 - `script/precommit`: run by the git pre-commit hook; runs `script/check`.