Merge the "release/v1.2.4+node24.14.1" branch into the "maintenance/v1+node24" branch

This merge promotes `release/v1.2.4+node24.14.1` into `maintenance/v1+node24`, marking the next patch release on the Node.js 24 maintenance line. It consolidates one deployment workflow update in `.github/workflows/deployment.yml` that disables implicit Docker metadata tags and one documentation update in `README.md` aligning versioning examples, the builder-stage example, and the size badge with the current release conventions.

In `.github/workflows/deployment.yml`, `Extract metadata (tags, labels)` now adds `flavor:` with `latest=false` so tag builds only emit the explicit version tag derived from `type=ref,event=tag`. `Normalize tag (match tag)` and `Normalize promote name (floating tag)` now add the same `flavor:` setting so manual promotion source and destination normalization only emit the explicit `workflow_dispatch` tag inputs. In `README.md`, the centered header size badge is updated from `~45MB` to `<50MB`; the Docker Hub, GHCR, and versioned `FROM runtimenode/runtime-node:...` examples are updated from `v<image_semver>+node<node_version>` to `v<major>.<minor>.<patch>-node<node_version>`; the versioned builder example is updated from `FROM node:<node_version>-alpine AS builder` to `FROM node:<node_version>-alpine3.23 AS builder`; and the Versioning and Tags section is updated from `v<image_semver>+node<node_version>` with example `v1.2.3+node24.14.1` to `v<major>.<minor>.<patch>+node<node_version>` with example `v1.2.4+node24.14.1`, with a new note explaining that `docker/metadata-action` normalizes `+` to `-` in published registry tags.

No migration steps are required beyond updating to `v1.2.4+node24.14.1` on the `maintenance/v1+node24` line.

Author: Amnoor

.github/workflows/deployment.yml

@@ -93,6 +93,8 @@ jobs:
             # Only create tags derived from the Git tag.
             # No floating tags (like "latest") are generated here.
             type=ref,event=tag
+          flavor: |
+            latest=false
 
       # Authenticate to Docker Hub so the workflow can push images.
       - name: Login to Docker Hub
@@ -179,6 +181,8 @@ jobs:
             ${{ env.GHCR_IMAGE }}
           tags: |
             type=raw,value=${{ github.event.inputs.tag }}
+          flavor: |
+            latest=false
 
       # Extract only the tag portion from metadata-action output of the tag.
       - name: Extract normalized tag only
@@ -205,6 +209,8 @@ jobs:
             ${{ env.GHCR_IMAGE }}
           tags: |
             type=raw,value=${{ github.event.inputs.promote_name }}
+          flavor: |
+            latest=false
       
       # Extract only the promote name portion from metadata-action output of the floating tag.
       - name: Extract normalized promote tag

README.md

@@ -10,7 +10,7 @@
 [![Docker Hub](https://img.shields.io/docker/pulls/runtimenode/runtime-node?label=Docker%20Hub)](https://hub.docker.com/r/runtimenode/runtime-node)
 [![GHCR](https://img.shields.io/badge/GHCR-ghcr.io%2FRuntimes--Node%2Fruntime--node-blue)](https://github.com/Runtimes-Node/Runtime-Node/pkgs/container/runtime-node)
 [![Platforms](https://img.shields.io/badge/platforms-linux%2Famd64%20%7C%20linux%2Farm64-lightgrey)](https://hub.docker.com/r/runtimenode/runtime-node)
-[![Size](https://img.shields.io/badge/size-%7E45MB-green)](https://hub.docker.com/r/runtimenode/runtime-node)
+[![Size](https://img.shields.io/badge/size-%3C50MB-green)](https://hub.docker.com/r/runtimenode/runtime-node)
 [![Vulnerabilities](https://img.shields.io/badge/vulnerabilities-0-brightgreen)](https://hub.docker.com/r/runtimenode/runtime-node)
 
 </div>
@@ -70,7 +70,7 @@ These are the two primary size-focused official variants documented by the Node
 
 ```bash
 # Pull the versioned published tag
-docker pull runtimenode/runtime-node:v<image_semver>+node<node_version>
+docker pull runtimenode/runtime-node:v<major>.<minor>.<patch>-node<node_version>
 ```
 
 - Latest (Not Recommended for Production):
@@ -86,7 +86,7 @@ docker pull runtimenode/runtime-node:latest
 
 ```bash
 # Pull the versioned published tag
-docker pull ghcr.io/runtimes-node/runtime-node:v<image_semver>+node<node_version>
+docker pull ghcr.io/runtimes-node/runtime-node:v<major>.<minor>.<patch>-node<node_version>
 ```
 
 - Latest (Not Recommended for Production):
@@ -102,7 +102,7 @@ docker pull ghcr.io/runtimes-node/runtime-node:latest
 
 ```Dockerfile
 # Use the same Node.js version as your final runtime stage base image
-FROM node:<node_version>-alpine AS builder
+FROM node:<node_version>-alpine3.23 AS builder
 
 WORKDIR /dist
 
@@ -111,7 +111,7 @@ COPY ./ ./
 RUN npm ci --omit=dev --no-cache
 
 # Use the same Node.js version as your builder stage base image
-FROM runtimenode/runtime-node:v<image_semver>+node<node_version>
+FROM runtimenode/runtime-node:v<major>.<minor>.<patch>-node<node_version>
 
 # Copy your production build artifacts only
 COPY --from=builder --chmod=555 dist/ /app/
@@ -175,11 +175,13 @@ Applications that need a different timezone can set `TZ` at runtime (timezone da
 ## Versioning and Tags
 
 Tags follow the pattern:
-- `v<image_semver>+node<node_version>` (example: `v1.2.3+node24.14.1`)
+- `v<major>.<minor>.<patch>+node<node_version>` (example: `v1.2.4+node24.14.1`)
 - `latest` tracks the most recent release.
 
 Check the GitHub Releases page for the current tag and Node.js version.
 
+> Because of the `docker/metadata-action`, all tags with `+`, turns into `-` (example: GitHub Releases `v1.2.4+node24.14.1` then it becomes `v1.2.4-node24.14.1` in the Docker Hub and GitHub Container Registry)
+
 ## Security Posture
 
 Runtime Node is built to minimize the attack surface: