Build Docker images only for releases

A push to main built and pushed the full multi-arch image as :main and
sha-<commit>, next to the release build of the same commit. The docker
workflow now runs only for v*.*.* tags (and builds without pushing for
pull requests), and a release publishes only its version tags and
latest. The tests and lint workflows still run on each push to main.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/docker.yml

@@ -2,8 +2,6 @@ name: docker
 
 on:
   push:
-    branches:
-      - main
     tags:
       - "v*.*.*"
   pull_request:
@@ -98,8 +96,6 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-            type=ref,event=branch
-            type=sha
 
       - name: Build and push Docker image
         uses: docker/build-push-action@v7