- dev images are built only when the push touched code that image uses (path filters); webdrop-files does not wait for the frontend build - one v* tag releases both images (:tag and :latest) after the shared checks - registry build and push live in scripts/ci-publish-image.sh, used by every workflow - containers: fix the api Containerfile (missing Sync project), add Containerfile.files, Quadlet units for the file service (prod and dev), env examples, and registry auto-update for the production units so each machine pulls only the image it runs