Build on push to main and version tags, push to ghcr.io with semver/branch/sha tags. PRs get build-only validation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>