Tests still run on every push. The docker job is gated on ref_type=tag, validates the tag is a strict vX.Y.Z semver, and publishes :<tag> plus :latest. No branch images (sha-* / main latest) anymore.
Implements SPEC.md: two listeners, one writer-preferring two-mode lock, Ollama unload before image jobs, ComfyUI history polling + VRAM free, optional model warm-up, healthz/metrics endpoints, streaming-safe reverse proxies, Dockerfile and Gitea Actions CI.
mram