fix(ci): gate docker publish on the offline test suite

docker.yml pushed the image for tags and master without waiting for the
test job, so a red commit could still be published. ci.yml is now also a
workflow_call target; docker depends on its result. The gate run has its
own concurrency group and never cancels a superseded run, so a docs-only
follow-up cannot drop the image of the code commit before it. The live
job is skipped for the gate call.

.github/workflows/ci.yml

@@ -34,6 +34,15 @@ on:
     # Weekly probe of the live endpoints, so external API changes surface.
     - cron: '0 3 * * 1'
   workflow_dispatch:
+  # Called by docker.yml as the publish gate. `gate` marks that call: its
+  # concurrency group is separate from the standalone run on the same ref, and
+  # it never cancels a superseded run, because each gate run carries its own
+  # commit's image (a docs-only follow-up must not drop the code commit's).
+  workflow_call:
+    inputs:
+      gate:
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -41,8 +50,8 @@ permissions:
 # A newer push to the same ref supersedes the older run; without this every
 # intermediate commit of a PR branch keeps a runner busy to completion.
 concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
+  group: ci-${{ inputs.gate && 'gate-' || '' }}${{ github.ref }}
+  cancel-in-progress: ${{ !inputs.gate }}
 
 env:
   # Panicking tests print their backtrace; free when nothing fails.
@@ -134,7 +143,7 @@ jobs:
 
   live:
     needs: test
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
+    if: ${{ !inputs.gate && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')) }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     continue-on-error: true