ci(docker): skip PR triggers — build only on push to main + release (#218)

Docker workflow no longer runs on pull_request events. Triggers
are now scoped to:
  - release: published      (release-please tags)
  - push to main            (after a PR merges)
  - workflow_dispatch       (manual run from Actions UI)

Rationale: multi-arch docker builds (amd64 + arm64 via QEMU
emulation) take 12-18 minutes on cold cache, 3-6 minutes on
warm cache. Running them on every PR (even with the paths-filter
scoping to docker-related files) blocks PR review feedback and
slows the iteration loop.

Trade-off accepted:
  - Docker breakage is now caught one step later: after a PR
    merges to main, not during PR review.
  - Easy to revert with a follow-up PR if a breaking change
    lands on main.
  - release.yml will fail loudly if the post-merge image build
    is broken, so we still get a hard signal before tagging
    a release.

Docker files (Dockerfile, .dockerignore, docker-compose.yml,
docker.yml) change rarely — most PRs are unaffected by this
change.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

Author: parth0025

.github/workflows/docker.yml

@@ -26,21 +26,16 @@ name: Docker
 # ─────────────────────────────────────────────────────────────────────
 
 on:
+  # Build + publish image when a release tag is cut by release-please
   release:
     types: [published]
+
+  # Build + publish image on every commit to main (after a PR merges)
   push:
     branches:
       - main
-  pull_request:
-    branches:
-      - main
-    paths:
-      - 'Dockerfile'
-      - '.dockerignore'
-      - 'docker-compose.yml'
-      - '.github/workflows/docker.yml'
-      - 'package.json'
-      - 'frontend/package.json'
+
+  # Manual trigger from the Actions UI
   workflow_dispatch:
 
 permissions: