build.yaml (PR only):
- cargo build + test + clippy
- Docker build + push with SHA tag (no :latest)
- Image exists in registry after PR CI passes
deploy.yaml (main push only):
- docker pull SHA image (already in registry from PR)
- docker tag as :latest
- docker push :latest
- No rebuild, no cargo steps
