ci: build only on dev push and release tag, not on main merge

Merging to main now runs CI checks only. The release tag (v*) is the
sole trigger for a production :latest image, eliminating the redundant
double-build that previously occurred on every PR merge + tag pair.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -1,7 +1,7 @@
 # CI runs first; build only proceeds if all checks pass.
 #
 # Push to dev:  typecheck + lint + test → build :dev + :<sha>
-# Push to main: typecheck + lint + test → build :latest + :<sha>
+# Push to main: typecheck + lint + test only (no build — wait for release tag)
 # Tag v*:       typecheck + lint + test → build :latest + :<sha> + :<version>
 # Pull request: typecheck + lint + test only (no build)
 #
@@ -98,8 +98,12 @@ jobs:
   build:
     name: Build & push image
     needs: [typecheck, lint, test]
-    # Only build on branch/tag pushes — not on pull requests
-    if: github.event_name == 'push'
+    # Build on dev branch pushes and version tag pushes only.
+    # main branch pushes run CI for safety but do not build —
+    # the release tag (v*) is the sole trigger for a production image.
+    if: |
+      github.event_name == 'push' &&
+      (github.ref == 'refs/heads/dev' || startsWith(github.ref, 'refs/tags/'))
     runs-on: py3.12-node22
     steps:
       - uses: actions/checkout@v6
@@ -109,9 +113,7 @@ jobs:
         run: |
           TAGS="${{ env.IMAGE }}:${{ github.sha }}"
           BUILD_VERSION="dev"
-          if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
-            TAGS="$TAGS,${{ env.IMAGE }}:latest"
-          elif [[ "${{ github.ref }}" == "refs/heads/dev" ]]; then
+          if [[ "${{ github.ref }}" == "refs/heads/dev" ]]; then
             TAGS="$TAGS,${{ env.IMAGE }}:dev"
           elif [[ "${{ github.ref }}" == refs/tags/* ]]; then
             TAGS="$TAGS,${{ env.IMAGE }}:latest,${{ env.IMAGE }}:${{ github.ref_name }}"