ci: build images from a dev branch and release tags, not every commit

Every push to master was triggering a build+push, since that's where
day-to-day commits land. Switch to two deliberate channels instead:
pushing to dev produces a rolling :dev tag for testing, and pushing a
v* tag produces :latest + the version tag for real releases. Plain
commits/merges to master/main no longer build anything on their own.

.gitea/workflows/docker-publish.yml

@@ -1,8 +1,12 @@
 name: Publish Docker image
 
+# Two channels, not one-image-per-commit:
+#   - push to `dev`   -> rolling `:dev` tag, for testing in-progress work
+#   - push tag `v*`   -> `:latest` + the version tag, for actual releases
+# Plain commits/merges to master/main build nothing on their own.
 on:
   push:
-    branches: [main, master]
+    branches: [dev]
     tags: ['v*']
 
 permissions:
@@ -20,6 +24,24 @@ jobs:
       - name: Compute lowercase image name
         run: echo "IMAGE_NAME=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
 
+      - name: Compute image tags
+        run: |
+          if [ "${{ github.ref_type }}" = "tag" ]; then
+            VERSION="${{ github.ref_name }}"
+            TAGS="${{ vars.REGISTRY_HOST }}/${IMAGE_NAME}:latest
+          ${{ vars.REGISTRY_HOST }}/${IMAGE_NAME}:${VERSION}
+          ghcr.io/${IMAGE_NAME}:latest
+          ghcr.io/${IMAGE_NAME}:${VERSION}"
+          else
+            TAGS="${{ vars.REGISTRY_HOST }}/${IMAGE_NAME}:dev
+          ghcr.io/${IMAGE_NAME}:dev"
+          fi
+          {
+            echo "TAGS<<TAGS_EOF"
+            echo "$TAGS"
+            echo "TAGS_EOF"
+          } >> "$GITHUB_ENV"
+
       - name: Log in to Gitea container registry
         uses: docker/login-action@v3
         with:
@@ -39,8 +61,4 @@ jobs:
         with:
           context: .
           push: true
-          tags: |
-            ${{ vars.REGISTRY_HOST }}/${{ env.IMAGE_NAME }}:latest
-            ${{ vars.REGISTRY_HOST }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
-            ghcr.io/${{ env.IMAGE_NAME }}:latest
-            ghcr.io/${{ env.IMAGE_NAME }}:${{ github.sha }}
+          tags: ${{ env.TAGS }}