Changes:
- Split monolithic test-build-push into separate jobs
- test job: runs on all branches + PRs
- build-push job: only runs on main push after test passes
- Move env vars to workflow level (GOPRIVATE, REGISTRY, IMAGE)
- Remove conditional docker installs - only in build-push
- Build-push depends on test passing
Now: PRs run tests only. Main pushes build image to registry.