Three path-filtered workflows (finance-api, auth-users, auth-gateway) each build, push to ghcr.io, and rollout to k3s on push to main. Deployment manifests updated from local image refs to ghcr.io with imagePullSecrets referencing a ghcr-credentials k8s secret. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>