ci: main publishes :latest (main is the production line)

main pushes now move :latest (in addition to the immutable :<sha>), so a
merge to main updates production's pointer directly — no separate release
needed just to refresh :latest. The v* release tag's distinct job becomes
the dated :<version> marker (it still refreshes :latest harmlessly). Still
no :main tag. Rules 47/46 + 10/4 updated to match on both instances.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -1,15 +1,15 @@
 # CI runs first; build only proceeds if all checks pass.
 #
 # Push to dev:        typecheck + lint + test + build :dev + :<sha>
-# Push to main:       typecheck + lint + test + build :<sha>  (no moving tag)
+# Push to main:       typecheck + lint + test + build :latest + :<sha>
 # Tag v* (release):   typecheck + lint + test + build :latest + :<version> + :<sha>
 #
-# Both dev and main are gated AND built. dev pushes move the :dev tag; main
+# Both dev and main are gated AND built. dev pushes move :dev; main pushes move
-# pushes publish only the immutable :<sha> image — no :main tag, because
+# :latest — main IS the production line, so :latest tracks main's tip and there
-# :latest (release-only) is the single production pointer and a :main alias
+# is no separate :main tag. Every push also gets an immutable :<sha> (the
-# would just duplicate it. Running CI on the main merge commit is intentional:
+# rollback point). A v* release tag additionally publishes the dated :<version>;
-# main is validated and its :<sha> image is the rollback point. The v* release
+# since main already moved :latest, the release tag's distinct job is that
-# tag is the ONLY trigger that publishes :latest plus the immutable :<version>.
+# :<version> marker (it refreshes :latest too, harmlessly).
 #
 # Successive pushes to the SAME ref supersede each other (see concurrency
 # below), so rapid pushes don't stack identical work; dev and main runs are
@@ -142,7 +142,7 @@ jobs:
   build:
     name: Build & push image
     needs: [typecheck, lint, test]
-    # Build on dev, main, and v* tag pushes. dev → :dev, main → (sha only),
+    # Build on dev, main, and v* tag pushes. dev → :dev, main → :latest,
     # tag → :latest + :<version>; every build also gets an immutable :<sha>.
     if: github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
     runs-on: python-ci
@@ -171,8 +171,9 @@ jobs:
               TAGS="$TAGS,${{ env.IMAGE }}:dev"
               ;;
             refs/heads/main)
-              # main publishes only the immutable :<sha> image (set above) —
+              # main IS the production line: publish :latest (plus the :<sha>
-              # no :main tag; :latest (release-only) is the production pointer.
+              # set above). No separate :main tag.
+              TAGS="$TAGS,${{ env.IMAGE }}:latest"
               BUILD_VERSION="main"
               ;;
             refs/tags/*)