ci: emit commit short-SHA tag on docker publish

On every tag push, also tag the published image with the commit's short SHA
(type=sha,prefix=,format=short) alongside the human-readable tag, so
downstream consumers can pin to a specific commit hash without chasing
the tag name.

Author: asaf-sw

.github/workflows/sequencer_docker-publish.yml

@@ -57,6 +57,9 @@ jobs:
             type=semver,pattern={{raw}}
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
+            # Commit-hash tag: published on every tag push, lets downstream consumers
+            # pin to a specific commit without needing to chase the human-readable tag.
+            type=sha,prefix=,format=short,enable=${{ startsWith(github.ref, 'refs/tags/') && 'true' || 'false' }}
             # Manual workflow dispatch
             type=raw,value={{branch}}{{tag}}-{{sha}},enable=${{ github.event_name == 'workflow_dispatch' }}