Drop :latest tag from runner image build (security/M-007)

Railway pins the deploy to the SHA-tagged image (see "Deploy pinned image
to Railway" step), so :latest was never the source of truth for the
running container. Pushing it alongside the SHA tag was an unused-but-
loaded gun: any operator who pointed a service at :latest during incident
response would silently pick up whatever was last built, with no
provenance pin.

Removing it shrinks the supply-chain blast radius: a compromised contributor
with talos-branch push access can no longer poison a long-lived floating
tag that someone might fail over to.

Author: apexearth

.github/workflows/actions-image.yml

@@ -46,9 +46,7 @@ jobs:
           file: ./dockerfile-actions
           push: true
           ssh: default
-          tags: |
-            ${{ steps.prep.outputs.image_name }}:latest
-            ${{ steps.prep.outputs.image_name }}:${{ github.sha }}
+          tags: ${{ steps.prep.outputs.image_name }}:${{ github.sha }}
 
       # `railway redeploy` re-runs the last deployment using the digest
       # Railway already had — it does NOT pull a fresh `:latest` from GHCR,