Gate publish-main on lint job

Address Codex review feedback by requiring the publish-main job to wait for lint, test, and lint-actions jobs. This prevents publishing main images when lint or vulnerability checks fail.

---
_Generated with [`mux`](https://github.com/coder/mux) • Model: `openai:gpt-5.3-codex` • Thinking: `xhigh`_

Author: ThomasK33

.github/workflows/ci.yaml

@@ -103,7 +103,7 @@ jobs:
 
   publish-main:
     name: Publish GHCR :main
-    needs: [test, lint-actions]
+    needs: [test, lint, lint-actions]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions: