CI: no image build on PRs; images are built only on release

The build-only image job on every PR goes: images are built when a
release is published (release.yml), so PRs don't wait on it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

docs/Development-Plan.md

@@ -280,7 +280,7 @@ accepted once a tag's image passes the e2e suite.
 - The image runs as its own user; state in `/var/lib/nisse-dev`, configuration
   mounted at `/etc/nisse-dev/nisse-dev.yaml`, secrets as environment variables,
   keys mounted read-only. Its `test` stage carries the tests over the installed
-  package, for `scripts/e2e.sh --image REF`. CI builds both on every PR;
+  package, for `scripts/e2e.sh --image REF`. Images are built only on release:
   `release.yml` pushes `gitea.dongar.net/dev/nisse-dev:<version>` and `:latest`
   on a published release (`REGISTRY_TOKEN`, the `dev` organization's).
 - The live bring-up's switch to the image waits for the next live test (it needs