ci(C-3): fix YAML parser-rejection in publish-canvas-image.yml

Mechanical porter inserted a duplicate `env:` block in
.gitea/workflows/publish-canvas-image.yml — the file already had
`env: { IMAGE_NAME: ghcr.io/molecule-ai/canvas }` so the second
`env: { GITHUB_SERVER_URL: ... }` block triggered Gitea's parser
error "yaml: mapping key 'env' already defined".

Merged the two blocks into one. Also clarified the dropped
workflow_dispatch comment that the porter left dangling above
`permissions:`.

Verified via fresh `docker logs molecule-gitea-1 --since 5m` after
push — no new parser-rejection warnings for publish-canvas-image.yml.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/publish-canvas-image.yml

@@ -36,16 +36,19 @@ on:
       # platform-only / docs-only / MCP-only merges.
       - 'canvas/**'
       - '.gitea/workflows/publish-canvas-image.yml'
-  # Manual trigger: use after a non-canvas merge that still needs a fresh
-  # image (e.g. a Dockerfile change lives outside the canvas/ tree).
+  # NOTE (Gitea port): the original GitHub workflow had a
+  # `workflow_dispatch:` manual trigger for the
+  # non-canvas-merge-but-need-fresh-image scenario. Dropped in the
+  # Gitea port (1.22.6 parser-finicky). Manual rebuilds require
+  # pushing an empty commit to canvas/ or running the operator-host
+  # build directly.
+
 permissions:
   contents: read
   packages: write  # required to push to ghcr.io/${{ github.repository_owner }}/*
 
 env:
   IMAGE_NAME: ghcr.io/molecule-ai/canvas
-
-env:
   GITHUB_SERVER_URL: https://git.moleculesai.app
 
 jobs: