Push to main mints the next vX.Y.Z patch tag, builds and pushes a
multi-arch image to the registry, and tags the repo. A manual
bump-version workflow handles minor/major bumps.
This workflow deliberately holds no deployment-repo credentials: the
repo is public, so the GitOps side polls the registry and pulls new
tags itself rather than being pushed to from here.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
