Changed docker registry behavior

.github/workflows/supply-chain.yml

@@ -12,10 +12,11 @@
 # tags (X.Y.Z, X.Y, X, `latest`; a pre-release tag gets only X.Y.Z) and a GitHub
 # Release is created.
 # No `sha-<commit>` tag is published: a master push only moves `latest`, and
-# GHCR keeps the superseded (now-untagged) manifests until they are pruned.
+# `cleanup` prunes the superseded (now-untagged) manifests right after.
 # Scheduled legs (weekly rebuild, Monday 04:00 UTC): rebuild + rescan + resign
-# (advancing base-image digests), and `cleanup` prunes superseded untagged
-# manifests and the legacy `sha-*` tags, keeping `latest` and release tags.
+# (advancing base-image digests). `cleanup` prunes superseded untagged
+# manifests and the legacy `sha-*` tags after every push (plus weekly + manual),
+# keeping `latest` and release tags.
 #
 # The L7 mTLS constraint is DOCUMENTED (docs/DEPLOYMENT.md) and lint-checked
 # here; it is explicitly NOT exercised end-to-end in CI.
@@ -246,9 +247,9 @@ jobs:
     needs: [merge]
     # GHCR has no retention and keeps untagged manifests, so every `latest` move
     # leaves the previous one behind. Delete untagged manifests and the legacy
-    # `sha-*` tags (keeping `latest` and every release tag); `needs: [merge]`
-    # avoids racing the in-progress per-arch (untagged) pushes.
-    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    # `sha-*` tags (keeping `latest` and every release tag) after every push;
+    # `needs: [merge]` avoids racing the in-progress per-arch (untagged) pushes.
+    if: github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-24.04
     permissions:
       contents: read

docs/DEPLOYMENT.md

@@ -530,7 +530,7 @@ on:
   `<X.Y.Z>`). No `sha-<commit>` tags are published. These tags are convenience
   references; the deploy path applies the mutable `latest` tag (see
   [Deploy path](#deploy-path-use-the-ghcrio-image)).
-- Registry cleanup (job `cleanup`, weekly + manual): GHCR has no retention and
+- Registry cleanup (job `cleanup`, after every push plus weekly + manual): GHCR has no retention and
   keeps superseded manifests as untagged versions, so the job deletes untagged
   manifests and the legacy `sha-*` tags, keeping `latest` and every release tag.
 - A vulnerability scan that fails on HIGH and CRITICAL (job `merge`, steps