fix: extract openclaw image tag from imageTag attribute instead of store path

The sed pattern on the store path basename gave 'tar.gz' because
buildLayeredImage outputs 'openclaw.tar.gz'. Use imageTag attribute
which returns the actual tag (e.g., '2026.4.14').

.gitea/workflows/ci.yml

@@ -129,10 +129,13 @@ jobs:
       - name: Generate image tag
         id: meta
         run: |
-          # Read the version from the nix definition
-          IMAGE_TAG=$(nix eval .#openclaw-image.outPath --raw 2>/dev/null | xargs basename | sed 's/.*-//')
+          # Read the image tag from the nix definition's tag attribute
+          # buildLayeredImage sets tag from openclawImageTag in default.nix
+          IMAGE_TAG=$(nix eval .#packages.x86_64-linux.openclaw-image.imageTag --raw 2>/dev/null || \
+                      nix eval .#openclaw-image.imageTag --raw 2>/dev/null || \
+                      nix eval .#openclaw-image.outPath --raw 2>/dev/null | xargs basename | sed 's/.*-//')
           # Fallback to short SHA if tag extraction fails
-          if [ -z "$IMAGE_TAG" ]; then
+          if [ -z "$IMAGE_TAG" ] || [ "$IMAGE_TAG" = "tar.gz" ]; then
             IMAGE_TAG=$(echo "${{ github.sha }}" | cut -c1-7)
           fi
           echo "tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT