ci(docker): add push-to-main trigger with dev tag and optimize build (#95)

- Trigger Docker build on push to main (with paths-ignore for docs/md/devenv)
- Push `dev` tag on main, `latest` + semver on release tags, build-only on PRs
- Skip QEMU/provenance/sbom for non-release builds to reduce CI time
- Rename ci.yml to migrations.yml for clarity

.github/workflows/migrations.yml

@@ -0,0 +1,66 @@
+name: Migrations
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "db/migrations/**"
+  pull_request:
+    branches: [main]
+    paths:
+      - "db/migrations/**"
+
+concurrency:
+  group: migrations-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  migrate:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:18-alpine
+        env:
+          POSTGRES_DB: memoh_test
+          POSTGRES_USER: memoh
+          POSTGRES_PASSWORD: memoh123
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U memoh"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 5
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Build
+        run: go build -o memoh-server ./cmd/agent
+
+      - name: Generate config
+        run: |
+          cat > config.toml <<'TOML'
+          [postgres]
+          host = "127.0.0.1"
+          port = 5432
+          user = "memoh"
+          password = "memoh123"
+          database = "memoh_test"
+          sslmode = "disable"
+          TOML
+
+      - name: Migrate up
+        run: ./memoh-server migrate up
+
+      - name: Migrate down
+        run: ./memoh-server migrate down
+
+      - name: Migrate up (idempotent)
+        run: ./memoh-server migrate up