Maintenance: safe CI split + Docker Hub doc standardization

[bishoyh]

Summary

• convert workflow to PR-safe test + publish-on-main split
• ensure Docker Hub login/push only in publish job
• standardize pushed tag and docs to docker.io/picotainers/genmap:latest

Safety checks

• PR job has no Docker Hub login and no push
• publish job depends on test and is gated to push on main only
• workflow YAML parses with yaml.safe_load

Notes

• Local Docker daemon is unavailable in this environment, so runtime verification is pending CI.