ci: restrict :latest tag to main branch only

Set flavor.latest=false so semver tag pushes no longer auto-add :latest. The explicit type=raw,value=latest,enable={{is_default_branch}} rule keeps :latest pinned to main, so a release tag won't shadow whatever main is currently shipping.

https://claude.ai/code/session_012rsJRUue9w7sBD3J5gmKWK

Author: claude

.github/workflows/ci.yml

@@ -181,6 +181,8 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.IMAGE_PREFIX }}/${{ matrix.component }}
+          flavor: |
+            latest=false
           tags: |
             type=raw,value=latest,enable={{is_default_branch}}
             type=raw,value=beta,enable=${{ github.ref == 'refs/heads/beta' }}