fix(ci): docker-publish version tag missing on workflow_dispatch

When docker-publish.yml is dispatched via workflow_dispatch (the
backfill path for tags that were created with GITHUB_TOKEN and didn't
fire downstream workflows), `type=ref,event=tag` produced no version
tag — that pattern only fires on push:tag events. Result: the v0.9.0
GHCR image was pushed but only got the `:latest` tag, not `:v0.9.0`.

Diagnosis: GHCR anonymous tags-list API after the v0.9.0 dispatch
shows only `latest`:
  curl -fsS -H "Authorization: Bearer $token" \
    https://ghcr.io/v2/dfrostar/neuralmind/tags/list
  → {"name":"dfrostar/neuralmind","tags":["latest"]}

Fix: switch to `type=raw,value=${{ env.RELEASE_TAG }}` which works
for both event paths (push:tag → RELEASE_TAG=github.ref_name,
workflow_dispatch → RELEASE_TAG=inputs.tag). The verify-pull job
already reads the first tag from metadata-action outputs, so it
naturally pulls the version-specific tag for its smoke test.

After this merges, the v0.9.0 image needs to be re-built:
  gh workflow run docker-publish.yml --ref main -f tag=v0.9.0
This will overwrite `:latest` (same content) and create `:v0.9.0`.

Future push:tag runs (once RELEASE_PLEASE_TOKEN is set per #98) are
also fixed by the same change — RELEASE_TAG is set from
github.ref_name in env, and type=raw reads it directly.

https://claude.ai/code/session_01SH6iHNAqeMJHXdq7ubVcuJ

Author: claude

.github/workflows/docker-publish.yml

@@ -69,11 +69,15 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          # type=ref,event=tag → :v0.9.0 from the pushed tag
-          # type=raw,latest → :latest only when the tag has no `-`
-          #   suffix (excludes v0.10.0-rc1, v1.0.0-beta1, etc.).
+          # type=raw,value=${{ env.RELEASE_TAG }} → :v0.9.0 from RELEASE_TAG.
+          # This works for BOTH push:tag (RELEASE_TAG = github.ref_name)
+          # AND workflow_dispatch (RELEASE_TAG = inputs.tag). The earlier
+          # `type=ref,event=tag` form only fired on push:tag, so workflow-
+          # dispatched runs produced only `:latest` with no version tag.
+          # type=raw,latest → :latest only when the tag has no `-` suffix
+          # (excludes v0.10.0-rc1, v1.0.0-beta1, etc.).
           tags: |
-            type=ref,event=tag
+            type=raw,value=${{ env.RELEASE_TAG }}
             type=raw,value=latest,enable=${{ !contains(env.RELEASE_TAG, '-') }}
           labels: |
             org.opencontainers.image.title=NeuralMind