CI: build release images only from vX.Y.Z tags

Tests still run on every push. The docker job is gated on ref_type=tag,
validates the tag is a strict vX.Y.Z semver, and publishes :<tag> plus
:latest. No branch images (sha-* / main latest) anymore.

SPEC.md

@@ -181,14 +181,14 @@ are new.
   `scratch`), non-root user, `EXPOSE 8188 11434`,
   `ENTRYPOINT ["/gpu-turnstile"]`.
 - `.gitea/workflows/ci.yml` (Gitea Actions):
-  1. on push and tag: `go vet`, `go test -race ./...`, `golangci-lint` if
+  1. on every push: `go vet`, `go test -race ./...`, `golangci-lint` if
      available in the runner image
-  2. build image with buildx, tags `:sha-<short>` and `:latest` on main,
-     `:<tag>` on tags
-  3. push to the Gitea registry `git.rambossek.at/<owner>/gpu-turnstile`
+  2. on a version tag only (`vX.Y.Z`, enforced): build the image with buildx
+     and push it to the Gitea registry
+     `git.rambossek.at/<owner>/gpu-turnstile` tagged `:<tag>` and `:latest`,
      using the workflow token (`${{ secrets.GITEA_TOKEN }}` / `gitea.actor`)
 - Release: a git tag `vX.Y.Z` produces the versioned image; the Open WebUI
-  compose pins that tag.
+  compose pins that tag. No images are built from branches.
 
 ## Deployment (target)