ci: run the offline suite once per commit

ci.yml also triggered on push to master/tags, so every such push ran the
suite twice: once standalone, once as docker.yml's publish gate. Drop the
push trigger; the gate becomes the only master/tag run, and docker waits
on it — one suite run per commit, and a red suite still blocks the image.

The gate runs on every non-PR push (its own `changes` job skips a
docs-only diff), so a push touching no build input is still tested. A
release tag runs the live-network suite through the gate, via an explicit
`live` input computed by the caller (the called workflow's github.ref is
not a dependable tag check).

.github/workflows/docker.yml

@@ -116,11 +116,17 @@ jobs:
   # commit whose tests are red. Pull requests skip it: their own CI run covers
   # the code, and the docker job there only proves the image still builds.
   ci:
-    needs: should-build
-    if: needs.should-build.outputs.build == 'true' && github.event_name != 'pull_request'
+    # The offline suite's only master/tag run (`ci.yml` has no push trigger).
+    # Every non-PR push runs it — the gate's own `changes` job skips the heavy
+    # work for a docs-only diff — independently of whether the image itself is
+    # rebuilt.
+    if: github.event_name != 'pull_request'
     uses: ./.github/workflows/ci.yml
     with:
       gate: true
+      # A release tag also runs the live-network suite: a tag push is trusted,
+      # so the fork-PR reason to skip it (no secrets) does not apply.
+      live: ${{ startsWith(github.ref, 'refs/tags/v') && 'true' || 'false' }}
 
   # No `actions/checkout` here on purpose: `docker/build-push-action` defaults
   # to the Git context (`https://github.com/<owner>/<repo>.git#<ref>`), so