ci: tag images by semver and point latest at newest release

Replace the raw latest-on-default-branch tag, which moved latest on every
main push, with metadata-action's latest=auto flavor so latest follows the
newest non-prerelease v* release. Add a {{major}} tag alongside the
existing version and major.minor semver tags; branch and SHA tags remain
for traceability of non-release builds.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -55,8 +55,11 @@ registry write permission on most Gitea instances. Create the token under an
 account with write access to the target package namespace, then store it as a
 repository Actions secret named `PACKAGES_TOKEN`.
 
-The published image is `<gitea-host>/<owner>/<repo>`, tagged by branch, semver
-(for `v*` tags), commit SHA, and `latest` on the default branch.
+The published image is `<gitea-host>/<owner>/<repo>`. Pushing a `v*` git tag
+produces semantic-version tags (`{{version}}`, `{{major}}.{{minor}}`,
+`{{major}}`), and `latest` is moved to that build when it is not a pre-release.
+Non-release builds on `main` are tagged by branch name and commit SHA only, so
+`latest` always points at the most recent release rather than the newest commit.
 
 ## Dependency updates