fix: derive Docker image branch tags from workflow event context

[Copilot]

Summary

The Docker publish workflow failed while exporting branch metadata because it derived GIT_BRANCH by listing merged remote branches and wrote a multiline value into GITHUB_ENV. This change makes branch/SHA resolution event-driven so Docker tagging works for push, workflow_run, and manual executions.

Changes

• Workflow context resolution

  • Check out the triggering commit directly for workflow_run jobs instead of relying on github.ref.
  • Resolve branch and SHA from event payload fields with local git fallback only when needed.

• Environment export hardening

  • Replace the remote-branch enumeration logic with a single branch value.
  • Write GIT_HASH_SHORT, GIT_BRANCH, and GIT_BRANCH_DOCKER_SAFE via printf to avoid malformed GITHUB_ENV entries.

• Docker tag stability

  • Preserve the existing Docker metadata/tagging flow while ensuring the branch-derived tag is always a single safe value.

env:
  EVENT_BRANCH: ${{ github.event.workflow_run.head_branch || github.ref_name }}
  EVENT_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
run: |
  git_hash_short=$(git rev-parse --short "$EVENT_SHA")
  printf 'GIT_HASH_SHORT=%s\n' "${git_hash_short}" >> "$GITHUB_ENV"
  git_branch="$EVENT_BRANCH"