ci: publish client image only for releases

[yyyyyt123]

What changed

• Stop publishing the native client image on ordinary pushes to main.
• Publish only for v* release tags or an explicit manual dispatch.
• Release tags still produce latest, the version tag, and the immutable sha-<commit> tag.
• Manual dispatch produces only the immutable SHA tag.

Why

The native client image changes much less frequently than the Python benchmark, and ordinary merges should not require Docker Hub credentials or trigger an unnecessary image build. This also prevents unrelated release merges from failing solely because image-publishing secrets are unavailable.

Validation

• python -m pytest tests/test_runtime_config_consistency.py -q — 19 passed
• Parsed the workflow trigger and verified it contains only push.tags: [v*] plus workflow_dispatch
• git diff --check