feat: add build-and-push and ssh-deploy composite actions with image tagging support

AGENTS.md

@@ -14,7 +14,7 @@ Logs into the container registry, sets up SSH key for `docker-build.haven`, crea
 - `image` (required) — full image ref without tag
 - `registry_password` (required) — registry password/token (use secrets)
 - `ssh_key` (required) — SSH private key for remote builder (use secrets)
-- `image_tag` (default `latest`) — tag to apply to the built image
+- `image_tag` (default `latest`) — comma-separated tag(s) to apply to the built image (e.g. `latest,abc1234`)
 - `registry_host` (default `git.ivanch.me`) — container registry hostname
 - `registry_username` (default `ivanch`) — registry username
 - `platforms` (default `linux/amd64,linux/arm64`) — target build platforms
@@ -44,6 +44,8 @@ SSH into a remote host, pull the latest images with `docker compose pull`, and r
 - `remote_dir` (required) — directory on the remote server containing docker-compose.yml
 - `ssh_port` (default `22`) — SSH port
 - `compose_files` (default empty) — space-separated compose file paths (applied via -f flags)
+- `image` (default empty) — image base (host/path/name, no tag); when set, every compose service matching this base is pinned to `image_tag` at deploy time
+- `image_tag` (default `latest`) — tag applied to `image` when set (single tag; no comma-lists)
 
 ## Workflow Template for New Projects