deploy: make the GHCR image and chart packages public

publish-server.yml publishes the Helm chart to oci://ghcr.io/byteveda/charts/flexiq-server since #877, and the step ends with an anonymous readability probe:

if ! DOCKER_CONFIG="$anonymous_docker_config" \
  HELM_REGISTRY_CONFIG="${RUNNER_TEMP}/helm-anonymous.json" \
  helm show chart "${CHART_REGISTRY}/flexiq-server" --version "$VERSION" >/dev/null; then
  echo "::error::Published chart is not anonymously readable. Make the GHCR package public and rerun."

GHCR creates organization packages private, and there is no public default to inherit here — ghcr.io/byteveda/flexiq-server answers UNAUTHORIZED: authentication required to an anonymous probe today, so the existing image package is private too. The chart package does not exist yet: server-v2.0.0 was tagged before the workflow change, so the first helm push happens on the next server release.

That means the next server-vX.Y.Z run publishes the chart, fails its own probe, and stops — after the image, tag, release and proto assets have already gone out. The guard is doing its job, but the fix is a console action nobody can take from CI.

An organization owner needs to set both GHCR packages to public:

• byteveda/flexiq-server (server image) — the helm install/docker pull commands in the chart README and the operator guide assume anonymous pulls today and currently fail for anyone without credentials.
• byteveda/charts/flexiq-server (Helm chart) — only appears after the first helm push, so this one is either a rerun of the failed release job or a flip immediately after the package is created.

Verification, from a machine with no GHCR credentials:

helm show chart oci://ghcr.io/byteveda/charts/flexiq-server --version <released-version>
docker pull ghcr.io/byteveda/flexiq-server:<released-version>

CONTRIBUTING.md records the requirement in the release runbook; this issue tracks actually doing it, and closing the gap between "documented" and "done".

Start with publish-server.yml and the release requirement in CONTRIBUTING.md. An organization owner must make byteveda/flexiq-server public, then make byteveda/charts/flexiq-server public after its first push or rerun the failed release. Verify both packages anonymously with the helm show chart and docker pull commands given in the issue.