publish_capability_images.sh does the whole thing: disk check, registry
login (with the exact ghcr token instructions), build, smoke test, push,
and the per-package URLs for flipping GHCR's default-private packages to
public. It is resumable — an image already built for this version is
skipped, so re-running after a failure doesn't rebuild 7 GB of torch —
and it pushes nothing until every image has answered /healthz.

Profiles can now declare apt packages their wheels need to COMPILE, in
`profiles/<name>.build-deps`, installed and purged inside a single layer.
`audio` needed it: deepfilternet pulls deepfilterlib, which has no cp312
wheel and compiles Rust extensions. It now builds at 7309 MB against
7260 for a profile that needs nothing, so the toolchain is provably not
in the image.

Built and healthy so far: images (7.74 GB), faceswap (7.57 GB),
embeddings (7.26 GB), audio (7.31 GB). ocr, stt, tts, video and voice
are untried — the script resumes into them.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0182DhR1eFNPQyGmDrpHbedY