backend: require confirmation for signed channel updates [CI]

ci/release-linux.sh

@@ -95,7 +95,7 @@ done
 push_tag() {
   local target_tag="$1" pushed=false
   for attempt in 1 2 3; do
-    if buildah push --tls-verify=true "$local_image" "docker://$image:$target_tag"; then
+    if buildah push --tls-verify=true --digestfile "$output/image.digest" "$local_image" "docker://$image:$target_tag"; then
       pushed=true
       break
     fi
@@ -124,3 +124,7 @@ else
     push_tag "$version"
   fi
 fi
+
+if [[ -z "$tag" ]]; then
+  bash "$root/ci/publish-release-offer.sh" backend "$image" "$(cat "$output/image.digest")" "$MOSHIRO_TAG" dev "$output/release"
+fi