ci: run on all branches but release only from main via git tag detection

- Trigger CI on push for all branches and on pull_request
- Detect SemVer release tags (vX.Y.Z) via git tag --points-at
- Run publish-image and stable-tag only for tagged commits on main
- Pass version_tag and sha to reusable workflows
- Prevent tag pushes from triggering additional workflows

https://chatgpt.com/share/e/699044d3-c1d8-8013-a40d-974d1fc69974

.github/workflows/publish-image.yml

@@ -1,7 +1,14 @@
 name: publish-image
 
 on:
-  workflow_call: {}
+  workflow_call:
+    inputs:
+      version_tag:
+        type: string
+        required: true
+      sha:
+        type: string
+        required: true
 
 jobs:
   build-and-push:
@@ -11,11 +18,11 @@ jobs:
       packages: write
 
     steps:
-      - name: Checkout
+      - name: Checkout (exact commit)
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.ref }}   # bei tag-push ist das der Tag-Ref
+          ref: ${{ inputs.sha }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -36,8 +43,8 @@ jobs:
         run: |
           set -euo pipefail
           IMAGE="ghcr.io/${{ github.repository }}"
-          RAW_TAG="${{ github.ref_name }}"   # e.g. v1.1.7
-          TAG="${RAW_TAG#v}"                 # -> 1.1.7
+          RAW_TAG="${{ inputs.version_tag }}"   # e.g. v1.1.8
+          TAG="${RAW_TAG#v}"                    # -> 1.1.8
           echo "tags=$IMAGE:$TAG,$IMAGE:latest" >> "$GITHUB_OUTPUT"
 
       - name: Build and push