fix(ci): publish versioned Docker tags via auto-tag dispatch

[wpfleger96]

Auto-tagged releases never published versioned container images. auto-tag-on-release-pr-merge.yml pushes the release tag with the default GITHUB_TOKEN, and GitHub's recursion guard suppresses every on: push trigger (including push: tags) for refs pushed with GITHUB_TOKEN. So docker.yml's on: push: tags: ["v[0-9]*"] never fired for a release. The result: ghcr.io/block/buzz only ever had :main and :latest, and every ghcr.io/block/buzz:vX.Y.Z returned manifest unknown (404).

release.yml has the identical dead on: push: tags trigger but is rescued by an explicit gh workflow run release.yml dispatch at the end of the auto-tag job. docker.yml was added later and was never wired into that rescue. This change mirrors the same approach — no PAT or GitHub App token is introduced.

Changes

auto-tag-on-release-pr-merge.yml

• After the existing release-build dispatch, add a sibling gh workflow run docker.yml -f version=... -f ref=v... step using the same GITHUB_TOKEN. (gh workflow run with GITHUB_TOKEN can dispatch other workflows — that is how release.yml is already kicked.)

docker.yml

• Add workflow_dispatch.inputs.version and inputs.ref (both optional, ref defaults to main), so inputless manual canary dispatch still works exactly as before.
• Pin the build job's checkout to inputs.ref on workflow_dispatch (github.ref is main on a dispatch, not the tag). Empty string preserves default checkout for push/PR events.
• Add value=${{ inputs.version }} to each type=semver line in both meta steps (build and merge jobs). type=semver derives the version from the git ref, which is main on a dispatch and would render nothing — the explicit value= supplies the version instead.

Why an empty value= is safe on the existing paths

metadata-action's procSemver treats an absent and an empty value identically (default is ''). When value is empty it falls back to this.context.ref stripped of refs/tags/. So:

• Human-pushed tag (push event, inputs.version empty): value="" → falls back to the tag ref → full semver family renders, unchanged.
• Release dispatch (version+ref set): checkout pins the tag commit; semver tags take inputs.version.
• Inputless canary dispatch (ref = main): value="" and ref is not a tag → semver tags render nothing, exactly as today (:main + :sha-<7> only).

actionlint passes clean on both workflows.

Post-merge backfill (manual, one-off)

This fix only affects future releases. To publish the already-tagged v0.3.26 (and any other versions you want) into GHCR, after merge run once against the tag ref:

gh workflow run docker.yml -f version=0.3.26 -f ref=v0.3.26 --repo block/buzz

Do not attempt the backfill from this branch pre-merge — docker.yml must accept the inputs first.