fix: disable sha tag on tag pushes to avoid invalid Docker tag

The sha tag template `prefix={{branch}}-` produces `:-hash` on tag
pushes because {{branch}} is empty, resulting in an invalid Docker
tag like `beshultd/deltaglider:-482f45f`. Only emit sha tags on
branch pushes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/docker-publish.yml

@@ -65,8 +65,8 @@ jobs:
             type=semver,pattern={{major}}
             # For PRs: tag as pr-<number>
             type=ref,event=pr
-            # Always include git sha for traceability
-            type=sha,prefix={{branch}}-
+            # Include git sha for traceability (only on branch pushes, not tags)
+            type=sha,prefix={{branch}}-,enable=${{ startsWith(github.ref, 'refs/heads/') }}
 
       - name: Build and push Docker image
         uses: docker/build-push-action@v5