fix: check out resolved release tag in build-test-push on dispatch

Plumb the resolved git ref from resolve-version through to the reusable
_docker-pipeline workflow so workflow_dispatch republishes build from the
specified tag instead of the caller's default branch HEAD.

Author: cursoragent

.github/workflows/_docker-pipeline.yml

@@ -56,6 +56,11 @@ on:
         type: string
         required: false
         default: "dev"
+      ref:
+        description: "Git ref to check out (e.g. refs/tags/v2.0.3). Empty checks out the caller's default ref — used by the publish workflow to build from the resolved release tag on workflow_dispatch."
+        type: string
+        required: false
+        default: ""
     secrets:
       DOCKERHUB_USERNAME:
         required: false
@@ -71,6 +76,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ inputs.ref }}
           persist-credentials: false
 
       - name: 🔨 Set up Docker Buildx

.github/workflows/publish-docker.yml

@@ -43,6 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.clean }}
+      ref: ${{ steps.version.outputs.ref }}
     steps:
       - name: 🏷️ Resolve version
         id: version
@@ -130,6 +131,7 @@ jobs:
       arch_label: ${{ matrix.arch }}
       push: true
       version: ${{ needs.resolve-version.outputs.version }}
+      ref: ${{ needs.resolve-version.outputs.ref }}
     secrets:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
       DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}