release.yml now calls docker-publish.yml via workflow_call instead of re-running all four image builds independently. docker-publish.yml gains workflow_call inputs (tag, version) for release context; branch trigger is narrowed to dev only (main changes only land via tagged releases). Each release previously built all four variants twice (~90 min) — once on merge to main, once on tag push. Now it builds once. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>