fix(cd): stream candidate images to Dev over restricted SSH

.gitea/workflows/container-cd.yml

@@ -76,7 +76,7 @@ jobs:
           docker build --pull=false "${cache_args[@]}" -f "${{ inputs.dockerfile }}" \
             -t "${{ inputs.image_name }}:sha-${{ gitea.sha }}" "${{ inputs.build_context }}"
           docker push "${{ inputs.image_name }}:sha-${{ gitea.sha }}"
-      - name: Candidate pull on Dev
+      - name: Configure restricted Dev deployment key
         if: ${{ inputs.deploy_service != '' && inputs.deploy_host != '' }}
         env:
           DEV_DEPLOY_SSH_KEY: ${{ secrets.DEV_DEPLOY_SSH_KEY }}
@@ -87,6 +87,17 @@ jobs:
           printf '%s\n' "$DEV_DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
           ssh-keyscan -H "${{ inputs.deploy_host }}" >> ~/.ssh/known_hosts
+      - name: Transfer candidate image to Dev
+        if: ${{ inputs.deploy_service != '' && inputs.deploy_host != '' }}
+        run: |
+          set -euo pipefail
+          docker save "${{ inputs.image_name }}:sha-${{ gitea.sha }}" | \
+            ssh -i ~/.ssh/id_ed25519 cicd-deploy@"${{ inputs.deploy_host }}" \
+              "load ${{ inputs.deploy_service }} ${{ inputs.image_name }}:sha-${{ gitea.sha }}"
+      - name: Candidate verification on Dev
+        if: ${{ inputs.deploy_service != '' && inputs.deploy_host != '' }}
+        run: |
+          set -eu
           ssh -i ~/.ssh/id_ed25519 cicd-deploy@"${{ inputs.deploy_host }}" \
             "candidate ${{ inputs.deploy_service }} ${{ inputs.image_name }}:sha-${{ gitea.sha }}"
       - name: Promote tagged release after candidate check