fix: Dockerfile build mem-cli binary + CI builds image on PRs

- rust:1.81 → rust:1-bookworm (track latest stable)
- cargo build --release → cargo build --release -p mem-cli
- Docker build runs on PRs (verify before merge)
- Push only on main/workflow_dispatch

.gitea/workflows/build.yaml

@@ -32,10 +32,16 @@ jobs:
         run: cargo check -p mem-ingest 2>&1 | tail -20 || true
 
       - name: Get short SHA
-        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
         id: sha
         run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
 
+      - name: Build Docker image
+        run: |
+          docker build --no-cache \
+            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
+            -t "${IMAGE}:latest" \
+            -f Dockerfile .
+
       - name: Registry login
         if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
         run: |
@@ -45,14 +51,6 @@ jobs:
           REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
           REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
 
-      - name: Build Docker image
-        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-        run: |
-          docker build --no-cache \
-            -t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
-            -t "${IMAGE}:latest" \
-            -f Dockerfile .
-
       - name: Push Docker image
         if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
         run: |