build.yaml: PR-only, runs build+test+clippy (no Docker) deploy.yaml: main+dispatch only, builds+pushes Docker image - Skips build/test/clippy (already passed in PR) - Tags with short SHA + latest - Uses FORGEJO_REGISTRY_USER/TOKEN secrets
