ci(260613-fp9): skip Docker publish for .gitea/.planning-only pushes

Add paths-ignore ['.gitea/**', '.planning/**'] to publish.yml's push
trigger. Doc/CI-only pushes to main (planning docs push straight to main;
workflow edits merge via PR) produce a byte-identical image (.dockerignore
already excludes .planning), so the build + :latest re-push was wasted.
paths-ignore skips only when every changed file matches; mixed code+docs
pushes still publish.

.gitea/workflows/publish.yml

@@ -1,6 +1,11 @@
 # Publishing / Releases
 #
-# Trigger: push to main — i.e. when any PR merges.
+# Trigger: push to main — i.e. when any PR merges — EXCEPT pushes whose changed
+# files are confined to .gitea/** (CI/workflow edits) and/or .planning/** (GSD
+# planning docs, which push straight to main under the unprotected .planning/*
+# branch-protection pattern). Those never alter the shipped image (.dockerignore
+# already excludes .planning), so the paths-ignore filter below skips a wasted
+# build + re-push. A push that also touches code/Dockerfile/manifests still publishes.
 # Image: git.bergerhouse.net/luckberg/familysync-api
 # Tags:
 #   :latest                        — moving pointer for easy pulls
@@ -25,6 +30,12 @@ name: Publish
 on:
   push:
     branches: [main]
+    # Doc/CI-only pushes produce a byte-identical image — skip the build entirely.
+    # paths-ignore skips the run only when EVERY changed file matches; a mixed
+    # push (code + .planning) still publishes.
+    paths-ignore:
+      - '.gitea/**'
+      - '.planning/**'
 
 env:
   MILESTONE: v1.1