- Trigger Docker build on push to main (with paths-ignore for docs/md/devenv)
- Push `dev` tag on main, `latest` + semver on release tags, build-only on PRs
- Skip QEMU/provenance/sbom for non-release builds to reduce CI time
- Rename ci.yml to migrations.yml for clarity