fix(ci): separate PR validation from image publishing

Validate container builds inside CI for pull requests, and publish images only after CI succeeds on main or when a release tag is pushed.

.github/workflows/image.yml

@@ -1,21 +1,12 @@
 name: Container Image
 
 on:
-  pull_request:
-    paths:
-      - Dockerfile
-      - package.json
-      - package-lock.json
-      - tsconfig.json
-      - integrity-check.cjs
-      - src/**
-      - public/**
-      - licensed/**
-      - scripts/**
-      - .github/workflows/image.yml
+  workflow_run:
+    workflows:
+      - CI
+    types:
+      - completed
   push:
-    branches:
-      - main
     tags:
       - v*
   workflow_dispatch:
@@ -31,11 +22,20 @@ concurrency:
 jobs:
   docker:
     name: Build container image
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')) ||
+      (github.event_name == 'workflow_run' &&
+        github.event.workflow_run.conclusion == 'success' &&
+        github.event.workflow_run.event == 'push' &&
+        github.event.workflow_run.head_branch == 'main')
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.ref }}
 
       - name: Prepare licensed assets
         run: node ./scripts/prepare-licensed-assets.cjs