Correct the docs that said this repo has no publishing targets

Both CLAUDE.md and README.md claimed there were deliberately no build or
push targets because the workflow owned publishing. That stopped being true
in 69fcc24, which moved publishing onto the Makefile so release.yaml could
call it — the docs described the arrangement that change replaced.

The claim was wrong in its reasoning too, not just out of date. It was
written on the assumption that riksdata and rd-web duplicated their
pipelines by having those targets. They never did: their workflows call
make and always have, which is what makes a green gate locally and a green
pipeline the same code instead of two descriptions of it. This repo was the
exception, for the single day it had a Makefile that nothing called.

Claude-Session: https://claude.ai/code/session_01S7R4gWTz5wh5xCY4nCSJjN

CLAUDE.md

@@ -24,9 +24,12 @@ Two things about this repo specifically:
 
 ## Checks
 
-`make fmt lint test helm-lint` mirrors `.gitea/workflows/ci.yaml`, so a green gate here means
-a green pipeline there. The one deliberate difference is `-race`, which CI does not run; see
-the comment on the `test` target.
+`make fmt lint test helm-lint` **is** what the pipeline runs — `ci.yaml` and `release.yaml`
+call these targets rather than restating them, the way riksdata and rd-web do. A green gate
+here and a green pipeline are the same code, not two descriptions of it. `test` adds `-race`,
+which the workflows do not have to ask for since they call the target; see the comment on it
+for why.
 
-There are deliberately no `build`/`push`/`helm-push` targets — the workflow owns publishing,
-and it builds multi-arch. Publishing happens by pushing a tag.
+`make release` (build + push the multi-arch image, package + push the chart) is what
+`release.yaml` invokes. Do not run it by hand — it refuses `VERSION=dev` for that reason, and
+publishing happens by pushing a tag.