Archived
Run the workflow on pull_request too, so tests + build + Trivy must pass before main can be merged (branch protection requires this check). Push the image only on a real push to main — never from a PR. Also standardises the workflow across all apps (three had drifted).