ci: make ci.yml the single coordinator workflow

- Trigger ci on push and pull_request only
- Convert publish-image and stable-tag to reusable workflows (workflow_call)
- Add detect-release job for strict SemVer tag detection (vX.Y.Z)
- Run tests first, then publish image, then move stable tag
- Remove direct tag/push triggers from publish-image and stable-tag

https://chatgpt.com/share/e/699044d3-c1d8-8013-a40d-974d1fc69974

.github/workflows/ci.yml

@@ -1,11 +1,47 @@
 name: ci
 
 on:
-  pull_request:
-  push:
-    branches:
-      - main
+  pull_request: {}
+  push: {}
+
+permissions:
+  contents: write
+  packages: write
 
 jobs:
+  detect-release:
+    runs-on: ubuntu-latest
+    outputs:
+      is_semver_tag: ${{ steps.detect.outputs.is_semver_tag }}
+    steps:
+      - id: detect
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Only true for tag refs like v1.2.3 (no suffix)
+          if [[ "${GITHUB_REF}" == refs/tags/* ]] && [[ "${GITHUB_REF_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "is_semver_tag=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "is_semver_tag=false" >> "$GITHUB_OUTPUT"
+          fi
+
   tests:
     uses: ./.github/workflows/reusable-test.yml
+    with:
+      python-version: "3.12"
+      matomo-token-description: "ci-token"
+
+  publish-image:
+    if: needs.detect-release.outputs.is_semver_tag == 'true'
+    needs: [detect-release, tests]
+    uses: ./.github/workflows/publish-image.yml
+    permissions:
+      contents: read
+      packages: write
+
+  tag-stable:
+    if: needs.detect-release.outputs.is_semver_tag == 'true'
+    needs: [detect-release, tests, publish-image]
+    uses: ./.github/workflows/stable-tag.yml
+    permissions:
+      contents: write