fix: release on full versions only, so the moving major tag can move

[BryanFRD]

v1.0.0 published fine, but the README tells people to write uses: FerrLabs/FerrFleet-Runner@v1, and v1 does not exist. That example fails with "unable to resolve action" for anyone who copies it, which is everyone.

The fix is a moving major tag, the same shape FerrLabs/FerrFlow@v4 uses. It cannot simply be pushed as things stand: the release workflow triggers on v*, so moving v1 would start a run, and type=semver produces no tags at all from a bare v1, so that run would push an image under no tag while re-signing the same digest.

Narrowing the trigger to v*.*.* makes the major tag free to move without rebuilding anything, and the README now says how to do both halves of a release instead of leaving it to memory.

No behaviour change for a real release: v1.0.0 matches v*.*.*.

[ferrfleet]

The narrowing does what the description says: Actions tag filters treat * as "anything but /", so v*.*.* still matches v1.2.3 (and prereleases like v1.2.3-rc.1, as v* did) while a bare v1 no longer fires. Signing stays digest-based, so nothing downstream is affected.

Nit: workflow_dispatch is still on the same job, and a manual run from a branch produces no type=semver tags either. That path fails at build-push-action rather than publishing untagged, so it is not the bug this PR fixes, but it is the one remaining way to start a release run with an empty tag list.

One inline nit on the README release steps. Nothing blocking.

[ferrfleet]

Nit: git tag -f v1 tags whatever HEAD happens to be, which is only the release commit if you have not pulled or committed anything since step one. Naming the version tag makes the command correct regardless of where you are standing.

Suggested change

	git tag -f v1 && git push -f origin v1
	git tag -f v1 v1.2.3 && git push -f origin v1