chore: add version tagging and fix CI branch

[Maikol]

No description provided.

[MoonBoi9001]

Looks good — fixes the CI branch trigger and adds proper semver tagging for releases.

A few optional improvements to consider (now or in a follow-up):

• Bump the other action versions — docker/login-action@v1 and docker/build-push-action@v2 are a few majors behind while metadata-action is now at v5
• Add workflow_dispatch — lets you manually trigger builds from the UI without pushing
• Add explicit permissions block — contents: read + packages: write follows least-privilege

None are blockers, just polish.

---

Review by @MoonBoi9001 with @claude

[RembrandtK]

I would be tempted to remove explicit branches, so that it happens on all branches.

[Maikol]

I don't think we want to trigger the workflow for all commits on any branch. Current workflow runs on pull request opened and on main branch after a PR is merged, I believe this should cover all use cases.