mram
5a0e181293
Tests still run on every push. The docker job is gated on ref_type=tag, validates the tag is a strict vX.Y.Z semver, and publishes :<tag> plus :latest. No branch images (sha-* / main latest) anymore.