The build job was running on every PR but never pushing the image,
wasting CI time. Gate the entire job on main pushes and simplify
the now-redundant per-step guards.

https://claude.ai/code/session_01FVsSU48JEru2VWWeLAN7Tn

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bff4255..8805608 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,6 +24,7 @@ jobs:
 
   build:
     needs: test
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.meta.outputs.version }}
@@ -34,7 +35,6 @@ jobs:
           bundler-cache: true
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -49,11 +49,11 @@ jobs:
           images: ghcr.io/${{ github.repository }}
           tags: |
             type=raw,value={{date 'YYYYMMDD'}}-${{ steps.short-sha.outputs.sha }}
-            type=raw,value=demo,enable=${{ github.ref == 'refs/heads/main' && github.event_name == 'push' }}
+            type=raw,value=demo
       - uses: docker/build-push-action@v6
         with:
           context: .
-          push: ${{ github.ref == 'refs/heads/main' && github.event_name == 'push' }}
+          push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
@@ -62,8 +62,7 @@ jobs:
             BUILD_DATE=${{ github.event.head_commit.timestamp }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-      - if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-        env:
+      - env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh release create "${{ steps.meta.outputs.version }}" --generate-notes