Migrate to custom oci registry

Signed-off-by: Bryan Frimin <bryan@probo.com>

contrib/claude/make.md

@@ -55,7 +55,7 @@ Individual codegen is driven by `go generate`:
 
 | Target              | Purpose                                           |
 | ------------------- | ------------------------------------------------- |
-| `make docker-build` | Build the Docker image (`ghcr.io/getprobo/probo`) |
+| `make docker-build` | Build the Docker image (`artifact.probo.inc/probo/probo`) |
 | `make sbom`         | Source SBOM (CycloneDX)                           |
 | `make sbom-docker`  | Docker image SBOM                                 |
 | `make scan`         | Vulnerability scan (Grype) on source + Docker     |

contrib/claude/release/README.md

@@ -1,6 +1,6 @@
 # Release
 
-The repository ships six independently-versioned tracks. Each has its own
+The repository ships seven independently-versioned tracks. Each has its own
 version source, its own `CHANGELOG.md`, its own tag pattern, and its own
 release workflow. Cutting a release means: bump the version, write a
 changelog entry, commit, tag, push.
@@ -13,6 +13,7 @@ changelog entry, commit, tag, push.
 | `proboctl`              | `proboctl/v*`                  | [proboctl.md](./proboctl.md)     |
 | `@probo/n8n-nodes-probo` | `@probo/n8n-nodes-probo/v*`   | [n8n-nodes-probo.md](./n8n-nodes-probo.md) |
 | `@probo/cookie-banner`  | `@probo/cookie-banner/v*`      | [cookie-banner.md](./cookie-banner.md) |
+| Helm chart (`probo`)    | `helm/v*`                      | [helm.md](./helm.md)                   |
 
 When the user asks for a release **without specifying a track**, follow
 [Step 1](#1-decide-which-tracks-to-release) below to detect which tracks
@@ -69,6 +70,10 @@ git log $(git describe --tags --abbrev=0 --match='@probo/n8n-nodes-probo/v*')..H
 # @probo/cookie-banner
 git log $(git describe --tags --abbrev=0 --match='@probo/cookie-banner/v*')..HEAD --oneline \
   -- packages/cookie-banner
+
+# helm chart
+git log $(git describe --tags --abbrev=0 --match='helm/v*')..HEAD --oneline \
+  -- contrib/helm
 ```
 
 If a track returns no commits, skip it. If all commits for a track are

contrib/claude/release/helm.md

@@ -0,0 +1,34 @@
+# Release Helm chart (`probo`)
+
+After confirming commits below, follow the
+[common steps](./README.md#3-common-steps-every-track).
+
+## Track facts
+
+- **Tag pattern**: `helm/v*`
+- **Version source**: `contrib/helm/charts/probo/Chart.yaml` (`version` field)
+- **Version bump**: Edit `version` in `contrib/helm/charts/probo/Chart.yaml`
+- **Changelog**: `contrib/helm/charts/probo/CHANGELOG.md`
+- **Files to stage**: `contrib/helm/charts/probo/Chart.yaml`,
+  `contrib/helm/charts/probo/CHANGELOG.md`
+- **Workflow**: `.github/workflows/release-helm.yaml`
+- **Path filter**: `contrib/helm`
+
+## Detect commits
+
+```shell
+git log $(git describe --tags --abbrev=0 --match='helm/v*')..HEAD --oneline \
+  -- contrib/helm
+```
+
+If empty or non-user-facing only, do not release this track.
+
+## Notes
+
+The chart has its own SemVer (`version`). `appVersion` in `Chart.yaml` is
+the default probod application version the chart deploys (image tag
+`v<appVersion>`). Bump `appVersion` when the chart should default
+to a newer probod release.
+
+CI packages the chart and pushes it to
+`oci://artifact.probo.inc/probo/probo`, then publishes a GitHub Release.

contrib/claude/release/probod.md

@@ -32,6 +32,6 @@ The changelog covers changes across all four components (`probod`,
 `@probo/console`, `@probo/trust`, `@probo/ui`).
 
 CI builds the frontends and Go binaries, builds and pushes the
-multi-arch image to `ghcr.io/getprobo/probo:probod-v<version>` (and
+multi-arch image to `artifact.probo.inc/probo/probo:v<version>` (and
 `:latest`), runs Trivy + cosign + attestations, and publishes the GitHub
 Release.