fix(ci): add pull_request trigger to publish-image workflow

Branch protection on main requires the publish / Build & push template
image check to pass for all PRs. The workflow previously only triggered
on push to main, so PRs could never satisfy branch protection.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

.github/workflows/publish-image.yml

@@ -8,6 +8,7 @@ name: publish-image
 on:
   push:
     branches: [main]
+  pull_request:
   workflow_dispatch:
 
 permissions: