ci: emit :latest only on semver tags, not every commit

Tagging :latest on every push to local made every CI run try to
overwrite the existing :latest manifest. The Gitea registry rejected
the overwrite, causing builds to fail. Branch builds now produce
only the immutable SHA tag; :latest is reserved for vX.Y.Z tag pushes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.farhoodlabs/.github/workflows/build-prod.yml

@@ -33,9 +33,9 @@ jobs:
         with:
           images: git.farh.net/farhoodlabs/paperclip
           tags: |
-            type=raw,value=latest
             type=sha,prefix=
             type=semver,pattern={{version}}
+            type=raw,value=latest,enable=${{ startsWith(gitea.ref, 'refs/tags/v') }}
 
       - name: Build and push
         uses: docker/build-push-action@v6

.github/workflows/build-prod.yml

@@ -33,9 +33,9 @@ jobs:
         with:
           images: git.farh.net/farhoodlabs/paperclip
           tags: |
-            type=raw,value=latest
             type=sha,prefix=
             type=semver,pattern={{version}}
+            type=raw,value=latest,enable=${{ startsWith(gitea.ref, 'refs/tags/v') }}
 
       - name: Build and push
         uses: docker/build-push-action@v6