feat: add oCIS 8.1.0 image and promote to latest stable

[DeepDiver1975]

Summary

Promotes oCIS 8.1.0 GA to the latest-stable image, replacing the 8.1.0-rc.2 release candidate.

• 8.1.0 now carries the floating tags 8.1 and 8 (moved off 8.0.5).
• 8.0.5 keeps only the 8.0 tag.
• The superseded 8.1.0-rc.2 matrix entry is removed. Already-published RC tags remain on Docker Hub; they just stop being rebuilt.
• README "Supported Tags" table updated to match.

No Dockerfile change is needed — v8/Dockerfile.multiarch already builds any release tag from VERSION, and 8.1.0 is a normal semver GA tag (still ships services/idp/package.json, so the pnpm build path runs as usual).

⚠️ Merge gate

The upstream owncloud/ocis v8.1.0 GA tag is not yet published (only v8.1.0-rc.1/-rc.2 exist as of authoring). The Dockerfile clones --branch v${VERSION}, so CI will be red until the GA tag lands. Hold merge until the build goes green:

```bash
git ls-remote --tags https://github.com/owncloud/ocis.git | grep v8.1.0
```

.trivyignore follow-up

Left v8/.trivyignore untouched intentionally. 8.1.0 may fix some of the 8.0.x CVEs (e.g. the golang.org/x/crypto batch). When CI runs the Trivy scan against the real 8.1.0 image, prune any CVEs it no longer flags.

Verification

CI (build + Trivy + smoke test) runs automatically. The smoke test asserts .productversion == 8.1.0 from https://localhost:9200/status.php.

🤖 Generated with Claude Code

[DeepDiver1975]

Verdict: correct change, do NOT merge yet — CI red was a timing race, now resolvable by a re-run.

CI failure (not a defect in this PR):

• Failing job: build (8.1.0) / build (amd64) — step "Build image (load for testing)". Root cause at v8/Dockerfile.multiarch clone step: git clone --branch v8.1.0 … fatal: Remote branch v8.1.0 not found in upstream origin (exit 128).
• The 4 CANCELLED jobs (8.0.5 amd64/arm64, 8.1.0 arm64) are fail-fast matrix siblings aborted by that failure; merge + update-docker-hub-description SKIPPED downstream. So one real failure, everything else collateral — matches your documented merge gate.

Why it can pass now:

• CI ran 07:01Z. Upstream owncloud/ocis v8.1.0 GA tag was created 2026-07-06 08:25Z (annotated, PGP-signed, "Release 8.1.0", commit 17e118d). It did not exist when CI ran; it does now.
• So the clone target is real — re-run the workflow and the build should go green. (Note: gh release view v8.1.0 still 404s — the git tag exists but no GitHub Release object yet. Only the tag matters for the Dockerfile clone.)

8.1.0 / promotion:

• 8.1.0 is a real GA tag (not the -rc.1/-rc.2 pre-releases), so promoting it to latest-stable (8.1, 8) and dropping 8 from 8.0.5 is correct.
• README table matches the matrix: 8.1.0, 8.1, 8 → latest stable; 8.0.5, 8.0; per-build example bumped to 8.1.0. Consistent.

Action: hold merge until you re-run CI and it's green against the now-published tag. No code change needed.

Heads-up: your main.yml diff here is byte-identical to PR 29's (both 9915448..6bd1fbc) — whichever merges first, the other conflicts. Consider dropping the matrix change from 29 (it's a docs PR) and landing it only here.

🤖 Generated with Claude Code