Drop the main-push trigger so not every merge builds multi-arch. Version tags
still publish pinned releases automatically; `latest` is published on demand by
running the workflow from main (workflow_dispatch, where is_default_branch still
applies the latest tag).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>