A push to main built and pushed the full multi-arch image as :main and sha-<commit>, next to the release build of the same commit. The docker workflow now runs only for v*.*.* tags (and builds without pushing for pull requests), and a release publishes only its version tags and latest. The tests and lint workflows still run on each push to main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>