fix(ci): resolve build-image.yml merge conflict from main

The `Merge branch 'main'` commit (088cbf3) landed build-image.yml with
unresolved conflict markers. Resolved to main's "Release workflow
revision" design: build-image.yml now triggers on `v*` tags only and
always publishes, because test-image.yml owns the PR/main test builds
and never publishes. Keeping the old PR/main triggers here would have
double-built and is now redundant.

Verified: go vet, go test ./..., shellcheck, yamllint, make smoke all pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build-image.yml

@@ -1,14 +1,6 @@
-<<<<<<< HEAD
-# Build the Crucible image (D7 trigger standard): PRs/main build only; tag `v*`
-# publishes registry.westgate.pw/deployment/crucible:<sha>. Never a mutable tag.
-||||||| f3211f0
-# Build the Crucible image. PR-first (D7): PRs build only; push to main also
-# publishes registry.westgate.pw/deployment/crucible:<git-sha>. Never a mutable tag.
-=======
 # Publish the immutable crucible:<sha> image on version tags.
 # PR/main test builds live in test-image.yml and never publish, so registry
 # packages are only generated for releases we intend to use (not on every merge).
->>>>>>> main
 #
 # Daemonless: the host-mode runner has no container runtime, so the image is
 # built by Nix (`nix build .#image`, see flake.nix) and pushed with skopeo
@@ -16,17 +8,8 @@
 name: build-image
 
 on:
-  pull_request:
   push:
-<<<<<<< HEAD
-    branches: [main]
     tags: ['v*']
-||||||| f3211f0
-    branches: [main]
-  pull_request:
-=======
-    tags: ["v*"]
->>>>>>> main
 
 env:
   REGISTRY: registry.westgate.pw
@@ -46,19 +29,8 @@ jobs:
       - name: Build OCI image (daemonless)
         run: nix build .#image
 
-<<<<<<< HEAD
+      # This workflow only runs on v* tags, so every run is a release publish.
-      # Publish only on a v* tag push. PRs and main pushes build but never push.
-||||||| f3211f0
-      # Publish only on main (post-merge). PRs verify the build but never push.
-=======
->>>>>>> main
       - name: Publish image
-<<<<<<< HEAD
-        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
-||||||| f3211f0
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-=======
->>>>>>> main
         env:
           REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
           REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}