ci: unify operator FerrFlow config into a single .ferrflow

.ferrflow

@@ -2,7 +2,8 @@
   "$schema": "https://ferrflow.com/schema/ferrflow.json",
   "workspace": {
     "recoverMissedReleases": true,
-    "skipCi": false
+    "skipCi": false,
+    "deferPublish": true
   },
   "package": [
     {
@@ -11,6 +12,23 @@
       "changelog": "CHANGELOG.md",
       "versionedFiles": [
         { "path": "go.mod", "format": "gomod" }
+      ],
+      "publishers": [
+        {
+          "kind": "docker",
+          "image": "ghcr.io/ferrlabs/ferrvault-operator",
+          "tags": ["{version}", "v{major}", "latest"],
+          "platforms": ["linux/amd64", "linux/arm64"],
+          "args": [
+            "--label", "org.opencontainers.image.source=https://github.com/FerrLabs/FerrVault",
+            "--label", "org.opencontainers.image.licenses=MPL-2.0"
+          ]
+        },
+        {
+          "kind": "helm",
+          "chart": "charts/ferrvault-operator",
+          "registry": "oci://ghcr.io/ferrlabs/charts"
+        }
       ]
     }
   ]

.github/workflows/publish.yml

@@ -1,11 +1,11 @@
 name: Publish
 
-# Runs FerrFlow's docker + helm publishers (ferrflow.publish.json) after
-# FerrFlow cuts a release tag on main. The release job only versions and
-# tags; publishing lives here, where the build toolchain (buildx, helm)
-# and GHCR auth are set up — the toolchain the minimal release runner
-# doesn't carry. `ferrflow publish` resolves the released version from the
-# git tag and runs each publisher idempotently.
+# Runs the docker + helm publishers declared in `.ferrflow` after FerrFlow
+# cuts a release tag on main. `.ferrflow` carries `deferPublish: true`, so
+# the release job only versions and tags — publishing lives here, where the
+# build toolchain (buildx, helm) and GHCR auth are set up. `ferrflow publish`
+# resolves the released version from the git tag and runs each publisher
+# idempotently.
 on:
   push:
     tags:
@@ -17,9 +17,6 @@ permissions:
   packages: write
   id-token: write
 
-env:
-  FERRFLOW_CONFIG: ferrflow.publish.json
-
 jobs:
   publish:
     name: Image + chart