Tag the add-on image latest only from main, and run CI on pre-release branches

[cayossarian]

• Add-on image tags. Every build tagged the image :latest beside its version, so a build dispatched from a pre-release branch would also have moved
  :latest. Only a build of main now gets :latest. Every build still pushes its version tag.
• Stable versions build only from main. An installed add-on pulls its image by version tag. A pre-release branch is cut while config.yaml still names
  the last release, so a dispatch from it before the version bump would overwrite that release's image. Off main, the build now refuses a version without
  a pre-release marker (aN, bN or rcN). On any ref, it refuses a version that is neither X.Y.Z nor such a pre-release.
• CI on pre-release branches. Tests and Lint & Type Check now run for pull requests into prerelease/** branches and pushes to them, as they do for main.
  Spec Provenance also runs on pull requests into those branches that touch the vendored catalogs, so the catalogs stay read-only there too.

Checks

• actionlint 1.7.12 with shellcheck over build-addon.yaml, tests.yaml, lint.yaml and spec-provenance.yaml: no findings.
• PyYAML reads the new triggers as ["main", "prerelease/**"].
• The tag step's script, taken verbatim from the workflow and run locally under bash:
  • main with 2.6.0: the version tag and :latest.
  • prerelease/2.7 with 2.6.0: refused.
  • prerelease/2.7 with 2.7.0b1: the version tag only.
  • a feature branch with 2.6.0: refused.
  • main with 2.6: refused as malformed.
  • a tag ref with 2.7.0rc1: the version tag only.
• pytest tests -q: 816 passed, 11 xfailed.
• pre-commit run --all-files: every hook passed.