Publish Docker images on merge to main, not just on tags

[rethab]

The fork inherited upstream's Docker workflow, which publishes to ghcr.io only when a release is cut. Between releases there was nothing to pull, even though every merge to main already produces a snapshot release and a Homebrew snapshot cask. Merges to main now publish an image too.

latest follows main, and releases publish version tags (1.2.3, 1.2). That is the opposite of the Docker default, where latest means "newest release", so it is called out in the README: pin a version tag if you want a stable image. Merges additionally get an immutable main-<sha> tag.

Building four platforms on every merge is only affordable if the build is fast, so the Dockerfile now cross-compiles with Go from the build platform instead of running anything under QEMU emulation. The runtime stage is kept free of RUN instructions to make that complete — its apk install of ca-certificates was redundant anyway, since Alpine ships the certificate bundle in the base image since 3.9 — so nothing ever executes on the target platform and the workflow needs no QEMU/binfmt setup at all. Cross-compiling meant swapping go install for go build, since go install refuses to cross-compile into GOBIN; the linker flags still come from the Makefile (new ldflags target), with the tag's v prefix stripped, so the version stamped into an image matches a release binary (1.2.3, not v1.2.3).

Smaller things that fall out of that:

• linux/arm/v8 is dropped from the platform list. No client asks for it — ARMv8 hardware reports linux/arm64, which we already build — so it was a redundant entry in the manifest.
• The runtime base moves from alpine:3.19 to 3.23, the release the builder already uses.
• The image now carries a signed provenance attestation, matching what the release and snapshot workflows already do for their artifacts. There is deliberately no build cache: a cache that any branch can write to is a way into the images we publish, which is the same reasoning that already keeps the Go cache off the release builds.