ci: stop tagging dev branch images as :latest

Only main publishes :latest. Dev pushes get :dev (plus sha/branch tags)
so operators pulling :latest are not surprised by unstable tip builds.

.github/workflows/ci.yml

@@ -73,11 +73,9 @@ jobs:
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
-            # Always publish branch tip tags; main also updates :latest.
+            # :latest is stable (main only). Dev pushes get :dev only — not :latest.
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
             type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }}
-            # While primary work is on dev, keep :latest in sync with dev too.
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/dev' }}
             type=sha,prefix=sha-
             type=ref,event=branch
             type=ref,event=pr

README.md

@@ -99,7 +99,7 @@ Colocated mode (default) uses the shared DB and in-process service HTTP. For `-w
 
 Preferred for operators. See the [Deployment Wiki](https://github.com/renorris/openfsd/wiki/Deployment) (source: [`wiki/`](wiki/)).
 
-Images: **`ghcr.io/renorris/openfsd`** (`:latest`, `:dev`, `sha-*`) published by CI on every push to `main` and `dev`.
+Images: **`ghcr.io/renorris/openfsd`** — CI publishes `:latest` from **`main` only**, `:dev` from **`dev`** (unstable), plus `sha-*` / branch tags.
 
 **Upgrading from PostgreSQL?** Use [`openfsd-migrate-to-sqlite`](cmd/openfsd-migrate-to-sqlite) and [Migrating from PostgreSQL](wiki/Migrating-from-PostgreSQL.md). Optional multi-node: rqlite + mesh (`CLUSTER_ENABLED`, see [wiki/Deployment](wiki/Deployment.md) and `docs/design/distributed-openfsd.md`).
 

wiki/Deployment.md

@@ -27,7 +27,7 @@ docker compose up -d
 3. **Configure Server** — see [Configuration](Configuration.md)
 4. Connect a client — [Client Connection](Client-Connection.md)
 
-Images: **`ghcr.io/renorris/openfsd`** (`:latest`, `:dev`, `sha-*`) published by CI on pushes to `main` and `dev`.
+Images: **`ghcr.io/renorris/openfsd`** — CI publishes `:latest` from **`main` only**, `:dev` from **`dev`** (unstable), plus `sha-*` / branch tags.
 
 ### Service selection
 

wiki/Home.md

@@ -23,5 +23,5 @@ Operator documentation for [openfsd](https://github.com/renorris/openfsd).
 
 ## Quick links
 
-- Images: `ghcr.io/renorris/openfsd` (`:latest`, `:dev`, `sha-*`)
+- Images: `ghcr.io/renorris/openfsd` (`:latest` = main, `:dev` = unstable tip, `sha-*`)
 - Protocol notes: repository `docs/`