Pushes to release-* branches now run the Release workflow and publish
immutable sha-* container images, the way pushes to main already do.
Without this, a release branch had no post-merge CI and no artifact to
run the pre-release test suites against before tagging.
The floating "main" image tag is only pushed for main builds; release
branches get the sha-* tag alone.