ci: build a version-tagged container on the release tag

[jcgraciosa]

docker-image.yaml matched branch pushes only, so v3.2.0 produced no
version-tagged laptop image and :v3.2.0 was added by hand afterwards.
tags: ['v*'] makes a release tag build like any other push; the semver
entries already in metadata-action then emit 3.2.0 and 3.2.

The release: published trigger in both workflows has never fired —
release.yml creates the Release with GITHUB_TOKEN, which raises no
workflow events. The comment in hpc-uw3-image.yml said the opposite.

Checklist (UW3 Style Charter — docs/developer/UW3_STYLE_CHARTER.md)

• I have read the Style Charter and followed it over the surrounding code (S2)
• No drive-by refactors, renames, or "while I was here" cleanups (S9)
• Bug fixes ship the regression test, written first, with level_* and tier_* markers (S8)
• No hedging names (maybe_ / try_ / do_) and no commented-out code (S3, S4)
• Every exception swallow states its sanctioned failure mode in a comment (S4)
• New data access uses .array / mesh.X.coords — no with ....access(...), no mesh.data (S7)
• Parallel safety considered — np2/np4 checked where swarm/mesh/solver dispatch is touched (S11)
• No pixi.toml / pixi.lock or other dependency changes riding in an unrelated PR
• AI-assisted work carries the attribution line below

S8 unticked: a workflow trigger cannot be covered by a tests/test_NNNN_*.py;
the guard is the next release tag producing the image.

Underworld development team with AI support from Claude Code