[andygrove]

Which issue does this PR close?

Closes #N/A.

Rationale for this change

The Docker workflow currently runs only for pushes to main, so pushing an RC or final release tag does not start the workflow even though its publish step is written to detect release tags. In addition, the existing publish path pushes latest for RC tags before the candidate has passed the ASF vote.

What changes are included in this PR?

• trigger the Docker workflow for numeric Rust release tags
• use the triggering ref name instead of git describe, since RC and final tags point to the same commit
• publish exact version tags for both RC and final releases
• update latest only for final, post-vote release tags
• grant the workflow explicit packages: write permission
• document the RC and final Docker publishing behavior

Are there any user-facing changes?

RC container images no longer replace the latest tag. Final release tags continue to publish both the versioned image and latest.

How was this tested?

• actionlint .github/workflows/docker.yml
• git diff --check
• exercised the tag-matching shell conditions with RC, final, Python, incomplete, and malformed tag names

[milenkovicm]

LGTM