ci: build images only on release tags, not on every push to main

A full build of both editions takes ~25 min on the fedora:host runner
(run 237: 10:46-11:10), too costly to repeat on every push to main.
build-image.yaml now triggers only on v*.*.* tags; the tag path already
publishes the image and kickstart as a release, so the main-only
upload-artifact step is dropped. Recipes are still linted and validated
on every push by ci.yml.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build-image.yaml

@@ -1,8 +1,10 @@
 name: build-image
 
+# Only a release tag builds images: a full build takes ~25 min on the runner,
+# too costly to repeat on every push to main. Recipes are still linted and
+# validated on every push by ci.yml.
 on:
   push:
-    branches: [main]
     tags: ["v*.*.*"]
 
 # Builds raw disk images of the two default-tier editions (see
@@ -85,16 +87,6 @@ jobs:
           ./build-image.sh --dish "$dish" --root-size ${{ matrix.root_size }}
           xz -T0 "build/$dish.img"
 
-      - name: Upload image and kickstart as artifact
-        if: github.ref == 'refs/heads/main'
-        uses: actions/upload-artifact@v3
-        with:
-          name: ${{ matrix.edition }}
-          path: |
-            build/${{ env.DISH }}.img.xz
-            cook/dishes/${{ env.DISH }}.cfg
-          if-no-files-found: error
-
       - name: Publish image and kickstart as release
         if: startsWith(github.ref, 'refs/tags/')
         uses: https://git.phyllo.me/devops/action-gh-release@v2