Apply path filters to the push (merge-to-main) trigger only, so merges that
do not change the image (CI/Renovate config, docs) skip the build and release.
Pull requests keep running unfiltered so the required check is always reported.
Add a concurrency group keyed by ref with cancel-in-progress on main, so a
newer merge cancels an older in-flight build and only the most recent release
is produced, avoiding tags that would be immediately replaced.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
