feat(ci): publish docker image on tag release

[o-az]

This PR enables automated Docker publishing when a tidx@* GitHub release is published and removes ambiguity around whether released changes are actually deployable, while also hardening tag handling to avoid unsafe metadata interpolation and preventing accidental latest rollbacks from backports or older tags.

• Trigger Publish Docker on release.published events.
• Guard release-triggered Docker jobs to only run for tidx@* tags.
• Check out the release/tag ref consistently via inputs.tag || github.ref.
• Generate image tags from type=ref,event=tag and optional guarded inputs.tag.
• Publish latest only for stable releases targeting the default branch.
• Keep GIT_REV=${{ github.sha }} build arg so /status continues exposing deployed revision.