fix(ci): separate PR validation from image publishing

Validate container builds inside CI for pull requests, and publish images only after CI succeeds on main or when a release tag is pushed.

.github/workflows/ci.yml

@@ -5,6 +5,8 @@ on:
   push:
     branches:
       - main
+    tags:
+      - v*
   workflow_dispatch:
 
 permissions:
@@ -49,3 +51,26 @@ jobs:
           NODE_ENV=dry-run node ./build/stand-alone/crawl.js
           NODE_ENV=dry-run node ./build/stand-alone/search.js
           NODE_ENV=dry-run node ./build/stand-alone/serp.js
+
+  validate-container:
+    name: Validate container build
+    runs-on: ubuntu-latest
+    needs: verify
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Prepare licensed assets
+        run: node ./scripts/prepare-licensed-assets.cjs
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build container image without publishing
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        with:
+          context: .
+          push: false