fix: set ghcr.io package visibility to public after Docker push

Users pulling the image without authentication get "unauthorized" because
ghcr.io packages default to private under an organization. Add a step in
both release workflows to explicitly set the container package to public.

https://claude.ai/code/session_01QovQeW26KfEEmU1KdFfCPU

.github/workflows/bump.yml

@@ -90,6 +90,13 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Make package public
+        run: |
+          gh api orgs/${{ github.repository_owner }}/packages/container/crumbs -X PATCH \
+            -f visibility=public
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:

.github/workflows/release.yml

@@ -50,6 +50,13 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Make package public
+        run: |
+          gh api orgs/${{ github.repository_owner }}/packages/container/crumbs -X PATCH \
+            -f visibility=public
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with: