GitHub Actions builds linux/amd64 and linux/arm64 on every push to main and pushes a single :latest tag to ghcr.io, so the container can be run without cloning or building. Tests gate the publish step.
