Apply path filters to the push (merge-to-main) trigger only, so merges that
do not change the image (CI/Renovate config, docs) skip the build and release.
Pull requests keep running unfiltered so the required check is always reported.
Add a concurrency group keyed by ref with cancel-in-progress, so a newer run
supersedes an older in-flight run: a fresh merge to main cancels the previous
build and only the most recent release is produced, avoiding tags that would
be immediately replaced.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>