ci: publish Docker images and the PyPI package from the release workflow

backend-release creates the GitHub release with GITHUB_TOKEN, and GitHub
never starts workflows from events that token produces, so the
`release: published` triggers on the Docker and PyPI publish workflows only
fired for releases made by hand. 0.18.0 got no Docker images for that
reason, and 0.19.0 reached PyPI by a manual run.

backend-release now calls both publish workflows after creating the release,
passing the version it tagged. Both workflows gain a `workflow_call` trigger
with a `version` input and read the tag from it or from the release event,
so a release created by hand still publishes through the release trigger.
The Docker Hub credentials are passed by name; the PyPI job authenticates
through trusted publishing, which matches the called workflow's filename and
environment, so the publisher configuration is unchanged.

Permissions in backend-release move from the workflow to the jobs: the
release job writes contents; the Docker call writes contents (the compose
file attached to the release) and packages; the PyPI call gets an OIDC token.

.github/workflows/backend-release.yml

@@ -1,5 +1,12 @@
 name: Backend release
 
+# A version bump on main tags the commit, creates the GitHub release, then
+# publishes the Docker images and the PyPI package by calling those workflows.
+# The release is created with GITHUB_TOKEN, and GitHub never starts workflows
+# from events that token produces, so the `release: published` triggers on the
+# publish workflows would not fire (0.18.0 got no images that way). Releases
+# created by hand still publish through those triggers.
+
 on:
   push:
     branches: [main]
@@ -7,8 +14,7 @@ on:
       - 'docsgpt/version.py'
   workflow_dispatch:
 
-permissions:
-  contents: write
+permissions: {}
 
 concurrency:
   group: backend-release
@@ -18,6 +24,11 @@ jobs:
   release:
     if: github.repository == 'arc53/DocsGPT'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      version: ${{ steps.ver.outputs.version }}
+      created: ${{ steps.check.outputs.exists == 'false' }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
@@ -71,3 +82,26 @@ jobs:
           gh release create "$VERSION" \
             --title "v$VERSION" \
             --generate-notes
+
+  docker:
+    needs: release
+    if: needs.release.outputs.created == 'true'
+    uses: $/.github/workflows/ci.yml
+    with:
+      version: ${{ needs.release.outputs.version }}
+    secrets:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+    permissions:
+      contents: write # release-assets attaches the compose file to the release
+      packages: write
+
+  pypi:
+    needs: release
+    if: needs.release.outputs.created == 'true'
+    uses: $/.github/workflows/pypi-publish.yml
+    with:
+      version: ${{ needs.release.outputs.version }}
+    permissions:
+      contents: read
+      id-token: write