ci: scope gate + image-build to branch pushes (skip tags)

Tag pushes ignore paths: filters, so a release tag spuriously rebuilt
the unchanged CI image and re-ran the gate on a commit the branch push
already gated. Add branches: ['**'] to both push triggers — tag pushes
no longer fire them (release.yaml owns tags). Pushing commits + a tag
together still gates the commits via the branch push.

.gitea/workflows/build-ci-image.yaml

@@ -13,6 +13,10 @@
 name: build-ci-image
 on:
   push:
+    # Branch pushes only. Tag pushes ignore `paths:` filters and would rebuild
+    # the (unchanged) image on every release tag — `branches: ['**']` excludes
+    # tags, so this runs only when a branch push actually changes an image input.
+    branches: ['**']
     paths:
       - '.gitea/ci-image/Dockerfile'
       - 'flake.nix'

.gitea/workflows/ci.yaml

@@ -8,6 +8,11 @@
 name: ci
 on:
   push:
+    # Branch pushes only — a tag push hits the same commit the branch push
+    # already gated, so `branches: ['**']` drops the redundant tag-triggered
+    # run (the release workflow owns tags). Pushing commits + a tag together
+    # still gates the commits via the branch push.
+    branches: ['**']
   pull_request:
 
 jobs: