fix(ci): push to GHCR on main branch before Docker Hub

[ian-flores]

Summary

The push-dockerhub job pulls from GHCR, but the image was only pushed to GHCR for PR builds. This adds a step to push to GHCR on main branch so push-dockerhub can pull and re-tag for Docker Hub.

Problem

On main branch:

1. Build job creates image locally
2. push-dockerhub job tries to docker pull from GHCR
3. Image doesn't exist in GHCR → pull fails

Fix

Added "Push to GHCR (main branch)" step that runs before push-dockerhub job.

Test plan

• Verify main branch build pushes to GHCR
• Verify push-dockerhub job successfully pulls and pushes to Docker Hub

[claude]

Claude finished @ian-flores's task —— View job

---

Review Complete

• Read review guidelines
• Analyze the workflow changes
• Create and submit review

The fix correctly addresses the root cause where push-dockerhub job pulls from GHCR but the image was never pushed there on main branch. Change is minimal and well-placed.

[claude]

The fix correctly addresses the root cause: push-dockerhub job (line 200) pulls from GHCR (line 214), but the image was never pushed there on main branch.

The change is minimal and well-placed - it reuses the existing full-image output and runs right after GHCR login.

LGTM.