ci: build Docker image only on version tags

Stop publishing on main push and remove GHCR; images go to Docker Hub only.

.github/workflows/docker-publish.yml

@@ -2,14 +2,12 @@ name: Publish Docker image
 
 on:
   push:
-    branches: [main]
     tags:
       - 'v*'
   workflow_dispatch:
 
 permissions:
   contents: read
-  packages: write
 
 env:
   IMAGE_NAME: pichost
@@ -31,44 +29,19 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Log in to Docker Hub
-        if: env.DOCKERHUB_USERNAME != '' && env.DOCKERHUB_TOKEN != ''
         uses: docker/login-action@v3
         with:
           username: ${{ env.DOCKERHUB_USERNAME }}
           password: ${{ env.DOCKERHUB_TOKEN }}
 
-      - name: Resolve image names
-        id: images
-        run: |
-          names="ghcr.io/${OWNER}/${IMAGE_NAME}"
-          if [ -n "${DOCKERHUB_USERNAME}" ]; then
-            names="${names}
-          ${DOCKERHUB_USERNAME}/${IMAGE_NAME}"
-          fi
-          {
-            echo "list<<EOF"
-            echo "${names}"
-            echo "EOF"
-          } >> "$GITHUB_OUTPUT"
-        env:
-          OWNER: ${{ github.repository_owner }}
-
       - name: Extract metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
-          # Same tags for ghcr.io and Docker Hub: latest + 1.0.0 (no v prefix)
-          images: ${{ steps.images.outputs.list }}
+          images: ${{ env.DOCKERHUB_USERNAME }}/${{ env.IMAGE_NAME }}
           tags: |
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
+            type=raw,value=latest
             type=semver,pattern={{version}}
 
       - name: Build and push