ci(registry): per-image build skip (only rebuild changed images)
detect-changes (.pre) computes changed images via WATCH regex per matrix entry; build/scan/promote skip if unchanged. Tag/release build all. Verified: frontend-only→1 build, docs-only→0 builds. Centralised detect (buildkit-rootless/trivy/docker lack git).