ci: a docs-only merge to main produced no image, so no :<sha> for that commit

Rule 145 promises every push to `main` publishes a `:<sha>`, so any production
commit is addressable without a release ceremony. `ci.yml`'s `paths:` filter
quietly broke that: a commit touching only docs never triggered the lane, so
that commit had no image and no sha tag.

Pre-existing — the filter has always been there — but it is rule 145's guarantee
and step 6 is where the tag set is being made to match the rule, so it is this
step's to close.

Confirmed live on a0c789b: a docs-only push produced two runs, both client lanes
skipping correctly, and NO image at all.

The server image now always builds. It is the cheap one — ~15 seconds against 6
and 9 minutes for the clients, which is exactly why they skip and it does not —
and always building is what keeps `python:3.12-slim` fresh on something that can
face the internet. That is also why §4's base-image tension does not bite this
project: the artifact it would apply to is the one that never skips.

#3146

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -25,18 +25,20 @@ name: CI & Build
 
 on:
   push:
+    # NO `paths:` FILTER, and unlike the client lanes this one does not skip either —
+    # the image ALWAYS builds. Two reasons:
+    #
+    #   * Rule 145 promises that every push to `main` publishes a `:<sha>`, so any
+    #     production commit is addressable. A path filter quietly broke that promise
+    #     for a docs-only merge: no trigger, no image, no sha tag for that commit.
+    #   * It is the artifact most exposed to base-image staleness (`python:3.12-slim`
+    #     is a floating tag and this can face the internet), and building every push
+    #     picks those updates up. That is why note 3127 §4's base tension does not
+    #     bite here — the one artifact it would apply to never skips.
+    #
+    # Affordable because it is the cheap one: ~15 seconds, against 6 and 9 minutes
+    # for the clients, which is why THEY skip and this does not.
     branches: [dev, main]
-    paths:
-      - "src/**"
-      - "frontend/**"
-      - "tests/**"
-      - "pyproject.toml"
-      - "alembic/**"
-      - "alembic.ini"
-      - "Dockerfile"
-      # The version deriver — see the note in desktop.yml.
-      - "packaging/**"
-      - ".forgejo/workflows/ci.yml"
   # Dispatched by the Android lane once it has published a client, so the image
   # that bakes it in is built AFTER the APK exists rather than racing it. See the
   # `gate` job below for the other half.