Fix Docker image tag and clarify distroless container usage

[Copilot]

The GHCR workflow published only branch/SHA tags, not latest, causing manifest errors. Documentation incorrectly suggested running cargo inside the distroless container.

Changes

Workflow: Added latest tag generation for default branch pushes

tags: |
  type=ref,event=branch
  type=ref,event=tag
  type=sha
  type=raw,value=latest,enable={{is_default_branch}}

Documentation: Split operational commands into local vs container contexts

• Local development: cargo run -p barffine-server -- create-admin <email> <password>
• Docker container: docker exec barffine barffine create-admin <email> <password>

The distroless runtime image contains only the compiled barffine binary—no shell, cargo, or Rust toolchain.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>ghcr repo is using master tag, not latest</issue_title>
<issue_description>documentation is incorrect, uses latest tag

 barffine Pulling 
 barffine Error manifest unknown
Error response from daemon: manifest unknown

should be master

even after pulling the master tag, the command docker exec barffine cargo run -p barffine-server -- serve does not work, exec-ing into a shell doesn't work either:

root@snuwtrpro[.../komodo/stacks/barffine/barffine-data]# docker exec -it barffine cargo run -p barffine-server -- serve
OCI runtime exec failed: exec failed: unable to start container process: exec: "cargo": executable file not found in $PATH: unknown
root@snuwtrpro[.../komodo/stacks/barffine/barffine-data]# docker exec barffine -it /bin/sh  
OCI runtime exec failed: exec failed: unable to start container process: exec: "-it": executable file not found in $PATH: unknown
root@snuwtrpro[.../komodo/stacks/barffine/barffine-data]# docker exec -it barffine /bin/sh
OCI runtime exec failed: exec failed: unable to start container process: exec: "/bin/sh": stat /bin/sh: no such file or directory: unknown
```</issue_description>

## Comments on the Issue (you are @copilot in this section)

<comments>
</comments>

• Fixes ghcr repo is using master tag, not latest #2

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.