ci: publish templates to the control panel on main

Adds `gbrgames export`, which builds the games_published payload from
every game.yaml, and a CI step that posts it to the panel webhook after
validation on main. Unlike the node-agent notify, a failed publish fails
the run so stale templates in the panel never go unnoticed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/validate.yml

@@ -7,6 +7,9 @@ on:
   push:
   workflow_dispatch:
 
+env:
+  PANEL_WEBHOOK_URL: https://api.gbrhosting.com/api/v1/webhooks/gitea
+
 jobs:
   validate:
     runs-on: ubuntu-latest
@@ -21,3 +24,23 @@ jobs:
 
       - name: Validate
         run: go run ./cmd/gbrgames validate
+
+      # main is the source of truth: send every template to the panel, which upserts them
+      # (new games arrive disabled). Unlike the node-agent notify, a failure here fails the run,
+      # because the panel would otherwise keep serving the previous templates silently.
+      - name: Publish to Control Panel
+        if: github.ref == 'refs/heads/main'
+        env:
+          PANEL_WEBHOOK_SECRET: ${{ secrets.PANEL_WEBHOOK_SECRET }}
+        run: |
+          if [ -z "$PANEL_WEBHOOK_SECRET" ]; then
+            echo "::error::PANEL_WEBHOOK_SECRET is not set; templates were not published"
+            exit 1
+          fi
+          go run ./cmd/gbrgames export -repo "${{ github.repository }}" -commit "${{ github.sha }}" -out payload.json
+          curl -sS --fail-with-body --max-time 30 --retry 3 --retry-delay 10 \
+            -X POST "${{ env.PANEL_WEBHOOK_URL }}" \
+            -H "Content-Type: application/json" \
+            -H "X-Gitea-Token: $PANEL_WEBHOOK_SECRET" \
+            -H "X-GBR-Event: games_published" \
+            --data-binary @payload.json