chore(ci): push Docker images last — after create-release gate

Watchtower polls GHCR on a 5-minute interval and was pulling stale
`latest` tags before the release workflow finished building all
artifacts. Move the three Docker image jobs (api, web, binaries)
behind `create-release` so images aren't pushed until everything
else is done. The `if` conditions tolerate create-release being
skipped during workflow_dispatch with skip_release.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ToddHebebrand

.github/workflows/release.yml

@@ -1633,7 +1633,7 @@ jobs:
   build-binaries-image:
     name: Build & Push Binaries Init Image
     runs-on: ubuntu-latest
-    needs: [build-agent, build-windows-msi, build-macos-agent, sign-windows-tauri, build-viewer, build-helper, build-viewer-macos, build-helper-macos]
+    needs: [build-agent, build-windows-msi, build-macos-agent, sign-windows-tauri, build-viewer, build-helper, build-viewer-macos, build-helper-macos, create-release]
     if: >-
       !cancelled()
       && needs.build-agent.result == 'success'
@@ -1644,6 +1644,7 @@ jobs:
       && needs.build-helper.result == 'success'
       && (needs.build-viewer-macos.result == 'success' || needs.build-viewer-macos.result == 'skipped')
       && (needs.build-helper-macos.result == 'success' || needs.build-helper-macos.result == 'skipped')
+      && (needs.create-release.result == 'success' || needs.create-release.result == 'skipped')
     permissions:
       contents: read
       packages: write
@@ -1719,7 +1720,11 @@ jobs:
   build-docker-api:
     name: Build & Push API Docker Image
     runs-on: ubuntu-latest
-    needs: [build-api]
+    needs: [build-api, create-release]
+    if: >-
+      !cancelled()
+      && needs.build-api.result == 'success'
+      && (needs.create-release.result == 'success' || needs.create-release.result == 'skipped')
     permissions:
       contents: read
       packages: write
@@ -1775,7 +1780,11 @@ jobs:
   build-docker-web:
     name: Build & Push Web Docker Image
     runs-on: ubuntu-latest
-    needs: [build-web]
+    needs: [build-web, create-release]
+    if: >-
+      !cancelled()
+      && needs.build-web.result == 'success'
+      && (needs.create-release.result == 'success' || needs.create-release.result == 'skipped')
     permissions:
       contents: read
       packages: write