Fix Docker publish workflow

[mafirs]

Summary

Fix the Docker publish workflow used after changes land on main.

This keeps production publishing on push to main, grants the required GHCR package permission, avoids using secrets.* directly in step if conditions, and preserves the published image tag output in the Actions log.

Verification

• Compared upstream/main and origin/main
• Created a dedicated PR branch from upstream/main
• Confirmed GitHub compare result: ahead_by: 1, behind_by: 0, files: 1
• Ran:

git diff --check upstream/main..HEAD

Rollback

Merge with Create a merge commit. If something goes wrong after merge, use GitHub's Revert action on this PR.

[github-actions]

🤖 Fork Repository Check Complete

✅ Basic security scan completed
✅ Dependency check completed
✅ Linting check completed
✅ Build test completed

This PR from a fork repository has passed basic safety checks. A maintainer will review the changes before running full CI/CD pipeline.

This is an automated safety check for contributions from fork repositories.