Map the image channels to how this repo ships, and disarm auto-publish

The channel work assumed the branch model it was written against: upstream,
main is a release branch and dev-be is the trunk. Neither holds here. main IS
our trunk - 212 commits past v0.11.3 - and a release is a tag (ADR-007). dev-be
does not exist at all, so the edge half would never have fired and the launchers
would have cloned a missing branch.

Taken literally it would have published our unreleased trunk to every site as
:stable, which is the opposite of what the word promises to someone who has no
way to check.

Remapped throughout:

  tag v*  -> :stable   the thing that was actually released
  main    -> :edge     the trunk, DEV badge lit

publish-images.yml keys the channel on github.ref_type = tag rather than on a
branch name, so the mapping cannot silently drift back. Start-ShopDBDev.ps1,
dev-bootstrap.ps1 and build-channel-installer.ps1 resolve stable to the newest
v* tag via git ls-remote --sort=-v:refname, warning and falling back to main if
a repo has no tags yet. DEV-BUILD-TEST.md follows.

The push: trigger is commented out. Automatic publishing waits on someone
confirming the GHCR package exists under this owner and deciding who may pull
it; workflow_dispatch works meanwhile. Turning it on is one uncomment.

All three scripts parse clean under pwsh, and the tag-selection expression was
run against this repo rather than eyeballed. Per the standing rule, the runtime
paths still want a pass in the win11 VM before anyone leans on them.

Scope: product

.github/workflows/publish-images.yml

@@ -8,22 +8,31 @@
 # A single image pull is one resumable HTTPS stream, far more robust through
 # the proxy than hundreds of npm requests.
 #
-# Channels map to branches:
-#   main   -> ghcr.io/<owner>/shopdb-flask:stable  (badge off)
-#   dev-be -> ghcr.io/<owner>/shopdb-flask:edge    (SHOPDB_ENV_LABEL=DEV badge)
+# Channels are mapped to how THIS repo actually ships, which is not how the
+# branch this came from ships. Upstream, main is a release branch and dev-be is
+# the trunk. Here main IS the trunk - it runs hundreds of commits past the last
+# release - and releases are tags (ADR-007). Publishing main as :stable would
+# put unreleased work behind a word that promises the opposite, to sites that
+# have no way to know:
 #
-# Each push to those branches rebuilds and republishes its channel tag, so
-# `edge` stays genuinely bleeding edge. The image is also tagged with the short
-# commit SHA for traceability and rollback.
+#   tag v*  -> ghcr.io/<owner>/shopdb-flask:stable  (badge off)  the release
+#   main    -> ghcr.io/<owner>/shopdb-flask:edge    (DEV badge)  the trunk
+#
+# The image also carries a short-SHA tag for traceability and rollback.
+#
+# Automatic publishing is OFF until someone confirms the GHCR package exists
+# under this owner and decides who may pull it. Re-enable by uncommenting the
+# push: block below; workflow_dispatch works meanwhile.
 
 name: publish-images
 
 on:
-  push:
-    branches:
-      - main
-      - dev-be
-  # Allow a manual rebuild/publish of the current branch's channel image.
+  # push:
+  #   tags:
+  #     - 'v*'
+  #   branches:
+  #     - main
+  # Manual rebuild/publish of the current ref's channel image.
   workflow_dispatch:
 
 # One in-flight publish per branch; a newer push supersedes an older one.
@@ -48,7 +57,10 @@ jobs:
         run: |
           owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
           image="ghcr.io/${owner}/shopdb-flask"
-          if [ "${{ github.ref_name }}" = "main" ]; then
+          # A tag is a release, anything else is the trunk. Deliberately not
+          # keyed on the branch name: a release here is a tag, so keying on
+          # "main" would label the trunk stable.
+          if [ "${{ github.ref_type }}" = "tag" ]; then
             channel="stable"
           else
             channel="edge"