build-push: move :latest on workflow_dispatch from main, not just push events

[stewartshea]

Summary

The tag-set case statement in .github/workflows/build-push.yaml only added the :latest alias for push events. Manually re-running the workflow on main via workflow_dispatch produced a fully-tagged canonical build but did not update the moving :latest pointer.

The bug

Before:

case "${{ github.event_name }}" in
  push)
    tags+=( "${repo_lc}:${sanitized_ref}" )
    if [ "${{ github.ref_name }}" = "main" ]; then
      tags+=( "${repo_lc}:latest" )
    fi
    ;;
  pull_request) ... ;;
  workflow_dispatch)
    tags+=( "${repo_lc}:${sanitized_ref}" )     # :latest NEVER appended
    ;;
esac

After: push and workflow_dispatch share an arm, so both apply the branch alias and :latest (gated on github.ref_name == "main" as before). pull_request stays separate.

Why it matters

• Consumers pulling :latest directly were stuck on the last automatic push to main.
• cc-catalog-svc and cc-registry-v2 use the canonical tag list (not :latest), so they now report a newer canonical tag while :latest still points at the older one — an inconsistency that surprised an operator when manually re-running a main build.

Compatibility

Trigger	Before	After
push to main	<canonical> + :main + :latest	unchanged
push to feature-x	<canonical> + :feature-x	unchanged
pull_request	<canonical> + :pr-N	unchanged
workflow_dispatch from main	<canonical> + :main	<canonical> + :main + :latest
workflow_dispatch from feature-x	<canonical> + :feature-x	unchanged

Only new behavior: workflow_dispatch on main now updates :latest.

Test plan

• Merge to main
• Run a manual workflow_dispatch on main and confirm :latest ends up pointing at the freshly-built canonical tag in GHCR
• Confirm the existing automatic-push behaviour on main is unchanged

Companion PRs

This change ships in lockstep across all 6 RunWhen codecollection repos so the registry behaviour is consistent. The catalog-side handling (in runwhen-contrib/codecollection-registry PR ccv/git-mirror) makes the same fix less critical by sorting canonical tags on real built_at timestamps, but moving :latest correctly here is still the right thing to do for direct docker pull users and for visual consistency in GHCR.

---

Note

Low Risk
Low risk: workflow-only change that adjusts Docker tag aliasing; main impact is which GHCR tags are moved on manual runs.

Overview
Ensures manual workflow_dispatch builds behave like push builds for tag aliasing by sharing the same case arm.

When dispatched on main, the workflow now also updates the moving :latest tag (in addition to the branch alias), preventing :latest from drifting behind the newest canonical image after manual rebuilds.

^{Reviewed by Cursor Bugbot for commit 8b4b3c4. Bugbot is set up for automated code reviews on this repo. Configure here.}