ci: reuse published images when the image sources are unchanged

Release hashes services/, migrations/ and config/; when images for that hash
already exist it skips CI and the build and only applies the new tags. Tagging
a release no longer recompiles the webmail.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs/RELEASING.md

@@ -11,10 +11,22 @@ the Oracle server.
 | Workflow | Runs on | Does |
 | :--- | :--- | :--- |
 | `ci.yml` | every push and pull request | language lint, Go and TypeScript suites against a real Postgres, webmail tests, a Trivy scan of the repository and of each image, and the whole stack brought up with compose |
-| `release.yml` | a push to `main`, a `v*` tag, or by hand | runs `ci.yml` again, builds the six images for `linux/amd64` and `linux/arm64`, publishes them, and on a tag creates the release |
+| `release.yml` | a push to `main`, a `v*` tag, or by hand | builds the six images for `linux/amd64` and `linux/arm64` after `ci.yml` passes, publishes them, and on a tag creates the release |
 
 Nothing is published unless the full suite passes first.
 
+### Images are reused, not rebuilt
+
+The images are built from `services/`, `migrations/` and `config/` and nothing
+else. `release.yml` hashes those three trees (the `inputs-<hash>` tag) and asks
+the registry whether images for that hash already exist. If they do, it skips
+the CI run and the build and only points the new tags (`latest`, `sha-<commit>`,
+the version) at the existing manifests, which takes about a minute.
+
+So these never recompile anything: a documentation or workflow change merged
+to `main`, and a version tag pushed on a commit whose images were just
+published. A change under the three trees rebuilds everything, as it should.
+
 Images go to the Gitea registry, one package per service:
 
 ```
@@ -39,10 +51,11 @@ logging in.
    git push gitea v1.2.3
    ```
 
-The tag triggers `release.yml` once more. It republishes the images under
-`1.2.3`, `1.2` and `1` (layers are cached, so this is quick) and creates the
-entry under **Releases** with the image list and the commit log since the
-previous tag. A tag with a hyphen (`v1.3.0-rc.1`) is marked as a pre-release.
+The tag triggers `release.yml` once more. Because the commit was already
+released from `main`, the images are reused: it adds the tags `1.2.3`, `1.2` and
+`1` to them without building, and creates the entry under **Releases** with the
+image list and the commit log since the previous tag. Tagging a commit whose
+`main` run has not finished (or never ran) builds it from scratch. A tag with a hyphen (`v1.3.0-rc.1`) is marked as a pre-release.
 
 Versions follow [Semantic Versioning](https://semver.org/): a change to a
 migration, a required environment variable, or a published port is at least a