Support semver tags in CI Docker builds

Trigger CI on tag pushes (v*) in addition to main. When building
from a git tag, push the semver version as a Docker tag alongside
:latest and :sha. Use fetch-depth: 0 so git describe sees tags.

Release flow:
  git tag v1.0.1 && git push origin v1.0.1
  → CI builds with VERSION=v1.0.1
  → pushes :latest, :sha, and :v1.0.1 to Docker Hub
  → Watchtower picks up :latest on the VPS

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: bricef

.github/workflows/ci.yml

@@ -3,6 +3,7 @@ name: CI
 on:
   push:
     branches: [main]
+    tags: ['v*']
   pull_request:
     branches: [main]
 
@@ -11,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # needed for git describe
 
       - uses: actions/setup-go@v5
         with:
@@ -27,9 +30,11 @@ jobs:
   docker:
     needs: check
     runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    if: github.event_name == 'push'
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - uses: extractions/setup-just@v2
 
@@ -49,3 +54,8 @@ jobs:
           just docker-build-cached
           just docker-push latest
           just docker-push ${{ github.sha }}
+
+          # If this is a tag push, also push the semver tag.
+          if [[ "${{ github.ref }}" == refs/tags/v* ]]; then
+            just docker-push "${{ github.ref_name }}"
+          fi