Release: build on a published release, as in inlaw_outlaw

- on: release (published), not on any v* tag: only a deliberate release
  builds an image; the version is its tag without the v, plus latest.
- docker/login-action, setup-buildx and build-push-action, as the runner
  already serves them for inlaw_outlaw; the version as a build argument
  and image label.
- Comments on why the registry needs a personal token (the job token's
  empty package scope) and that packages belong to the repository owner.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

Dockerfile

@@ -24,6 +24,8 @@ COPY nisse-ops nisse-ops
 RUN uv sync --frozen --no-dev --package nisse-dev --no-editable
 
 FROM python:3.12-slim AS runtime
+ARG VERSION=dev
+LABEL org.opencontainers.image.title=nisse-dev org.opencontainers.image.version=$VERSION
 RUN apt-get update \
     && apt-get install -y --no-install-recommends openssh-client \
     && rm -rf /var/lib/apt/lists/* \