- drop per-commit :sha tag (registry stays one tag per repo) - remove the built image and prune dangling layers after push so CI builds stop accumulating orphan images on the Unraid host