Don't push container images from unmerged pull requests

[kingdonb]

Problem

The GitHub Actions workflow currently pushes container images to ghcr.io from pull request builds, including unmerged branches like test-single-node. This means unmerged/experimental code gets published as versioned artifacts.

Example: PR #11 pushed v1.11.5-arm64-spin-tailscale from unmerged test-single-node branch.

Expected Behavior

• Pull requests: Build images but don't push to registry (validation only)
• Main branch: Build and push images with proper tags
• Optional: Use different tags for PR builds if pushing is needed (e.g., pr-123-abc1234)

Suggested Fix

Update .github/workflows/build-talos-images.yml:

env:
  PUSH: ${{ github.ref == 'refs/heads/main' && '1' || '0' }}

Or add conditional logic to only push on main branch pushes.

Priority

Low - Not blocking current demo work, but good practice for production workflows.

Labels: enhancement, ci/cd