ci: tighten release workflow cleanup policy

Rationalize the release workflow by adding top-level concurrency to avoid overlapping publish runs for the same ref and by restricting cleanup jobs to tag refs only.

Keep ci.yml as the PR/main validation gate while docker.yml remains focused on release publishing and post-release maintenance.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/ci.yml

@@ -25,17 +25,6 @@ jobs:
             echo "No Makefile check/lint/test targets found; skipping."
           fi
 
-      - name: Run Go tests (if present)
-        run: |
-          set -e
-          if [ -f go/go.mod ]; then
-            (cd go && go test ./...)
-          elif [ -f go.mod ]; then
-            go test ./...
-          else
-            echo "No Go module found; skipping."
-          fi
-
       - name: Build runtime image (if Dockerfile present)
         run: |
           set -e