ci: run the offline suite once per commit

ci.yml also triggered on push to master/tags, so every such push ran the
suite twice: once standalone, once as docker.yml's publish gate. Drop the
push trigger; the gate becomes the only master/tag run, and docker waits
on it — one suite run per commit, and a red suite still blocks the image.

The gate runs on every non-PR push (its own `changes` job skips a
docs-only diff), so a push touching no build input is still tested. A
release tag runs the live-network suite through the gate, via an explicit
`live` input computed by the caller (the called workflow's github.ref is
not a dependable tag check).

.github/workflows/ci.yml

@@ -1,19 +1,22 @@
 name: CI
 
-# Test/lint gate (offline, no secrets) on every push/PR, plus a live-network
-# job that exercises the real source sites and the token-gated pixiv tests.
+# Test/lint gate (offline, no secrets). Standalone on pull requests, schedule
+# and manual dispatch; a master/tag push does not trigger it directly — that
+# push is tested once, by docker.yml's `ci` gate, which calls this workflow
+# with `gate: true` and blocks the image on the result.
 #
 # Layering:
 #   changes — decides whether anything but documentation changed; a docs-only
-#           push/PR skips `test` (which then reports as skipped, not missing).
+#           diff skips `test` (which then reports as skipped, not missing).
 #   test  — fmt + clippy + the full offline unit suite + a release-profile
-#           build + cargo-audit dependency gate. Runs on every push and PR,
-#           including forks (it needs no secrets).
+#           build + cargo-audit dependency gate. Runs on PRs, and for a
+#           master/tag push under the docker gate; no secrets needed.
 #   live  — the #[ignore]d live-network tests plus the pixiv tests that are
-#           gated on PIXIV_REFRESH_TOKEN. Runs on schedule / manual dispatch
-#           / tag pushes only, because pull requests from forks cannot read
-#           repository secrets. continue-on-error keeps a flaky external site
-#           from blocking, while the run still records the outcome.
+#           gated on PIXIV_REFRESH_TOKEN. Runs on schedule / manual dispatch,
+#           and on a release tag (through the docker gate), because pull
+#           requests from forks cannot read repository secrets.
+#           continue-on-error keeps a flaky external site from blocking,
+#           while the run still records the outcome.
 #
 # Every action is pinned to a commit SHA (Dependabot keeps the pins current);
 # `dtolnay/rust-toolchain` deliberately stays on its channel ref, because the
@@ -26,9 +29,6 @@ name: CI
 #     PIXIV_REFRESH_TOKEN is absent or empty (empty = unset CI secret).
 
 on:
-  push:
-    branches: [master]
-    tags: ['v*']
   pull_request:
   schedule:
     # Weekly probe of the live endpoints, so external API changes surface.
@@ -43,6 +43,14 @@ on:
       gate:
         type: boolean
         default: false
+      # Passed by docker.yml for a release tag: the caller computes it from its
+      # own `github.ref`, so the called workflow needs no ref check of its own.
+      # A string (not boolean) on purpose: a boolean input fed by an expression
+      # arrives as the string "true"/"false", and "false" is truthy in `if`.
+      live:
+        description: Run the live-network suite too (docker passes "true" on a release tag).
+        type: string
+        default: 'false'
 
 permissions:
   contents: read
@@ -143,7 +151,7 @@ jobs:
 
   live:
     needs: test
-    if: ${{ !inputs.gate && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')) }}
+    if: ${{ inputs.live == 'true' || (!inputs.gate && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')) }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     continue-on-error: true

.github/workflows/docker.yml

@@ -116,11 +116,17 @@ jobs:
   # commit whose tests are red. Pull requests skip it: their own CI run covers
   # the code, and the docker job there only proves the image still builds.
   ci:
-    needs: should-build
-    if: needs.should-build.outputs.build == 'true' && github.event_name != 'pull_request'
+    # The offline suite's only master/tag run (`ci.yml` has no push trigger).
+    # Every non-PR push runs it — the gate's own `changes` job skips the heavy
+    # work for a docs-only diff — independently of whether the image itself is
+    # rebuilt.
+    if: github.event_name != 'pull_request'
     uses: ./.github/workflows/ci.yml
     with:
       gate: true
+      # A release tag also runs the live-network suite: a tag push is trusted,
+      # so the fork-PR reason to skip it (no secrets) does not apply.
+      live: ${{ startsWith(github.ref, 'refs/tags/v') && 'true' || 'false' }}
 
   # No `actions/checkout` here on purpose: `docker/build-push-action` defaults
   # to the Git context (`https://github.com/<owner>/<repo>.git#<ref>`), so