ci: scope gate + image-build to branch pushes (skip tags)

Tag pushes ignore paths: filters, so a release tag spuriously rebuilt
the unchanged CI image and re-ran the gate on a commit the branch push
already gated. Add branches: ['**'] to both push triggers — tag pushes
no longer fire them (release.yaml owns tags). Pushing commits + a tag
together still gates the commits via the branch push.

.gitea/workflows/ci.yaml

@@ -8,6 +8,11 @@
 name: ci
 on:
   push:
+    # Branch pushes only — a tag push hits the same commit the branch push
+    # already gated, so `branches: ['**']` drops the redundant tag-triggered
+    # run (the release workflow owns tags). Pushing commits + a tag together
+    # still gates the commits via the branch push.
+    branches: ['**']
   pull_request:
 
 jobs: