ci(docker): publish images only on version tags (rant 2026-08-22T07:14:15)

[argszero]

Summary

Docker publishing cadence change (rant 2026-08-22T07:14:15): align with the emrg release rhythm — publish images only when a release is explicitly tagged, not on every main push / PR merge.

Previously .github/workflows/docker-publish.yml triggered on branches: [main] + tags: ['v*'], so every merge to main built and pushed GHCR images (latest/main/sha constantly refreshed = "releasing on every commit").

Related Rant

• 2026-08-22T07:14:15 — Docker 发布机制：改为仅 tag 触发（对齐 emrg 发版节奏，rant 说发版才发版）

Changes

• .github/workflows/docker-publish.yml:
  • on.push now only tags: ['v*'] (removed branches: [main]) — main push / PR merge runs ci.yml only, no Docker build
  • added workflow_dispatch as a manual-trigger backup
  • metadata tags: type=ref,event=tag (vX.Y.Z) + type=sha + latest now enabled via {{is_tag}} (latest follows the newest version tag, no longer refreshed per commit)
• README.md / README.en.md: Docker section now states images are released on version tags and latest points to the newest release
• ci.yml untouched — tests still run on every main push / PR

Tests

• Workflow change only (no Rust/JS code touched): cargo test 139/139 passed, fmt --check clean, clippy clean
• YAML validated with yaml.safe_load

Acceptance

• Merging a normal PR to main: ci.yml runs, docker-publish does NOT trigger
• Tagging vX.Y.Z: docker-publish triggers and publishes vX.Y.Z + latest
• README docs updated