feat(ci): add merge_group triggers for merge queue support

[coopernetes]

Summary

• Adds merge_group to the on: triggers of every workflow that produces a required status check (ci.yml, codeql.yml, cve.yml, license.yml, docker-publish.yml) — without this, those checks never run against merge queue's temporary merge-group ref and a queued entry stalls forever.
• ci.yml / docker-publish.yml: cancel-in-progress now excludes merge_group runs — cancelling a required check on a queued entry fails it and can force the whole batch to requeue.
• docker-publish.yml: fixes the GHCR login and image-attestation steps, previously gated on github.event_name != 'pull_request' (which also evaluates true for merge_group) — they'd try to attest a digest from an image that was never pushed, since push: itself is gated on push/workflow_dispatch only. Both conditions now match the push condition.

⚠️ Not yet enabled — branch ruleset needs a follow-up change

These workflow triggers are a no-op until the "Protect main & releases" branch ruleset also gets a merge_queue rule added. That's a repo-settings change (not a file in this repo) — still pending, planned as:

• merge_method: MERGE (matching the repo's merge-commit-only setting — allow_squash_merge/allow_rebase_merge are already off)
• GitHub defaults otherwise (min_entries_to_merge: 1, max_entries_to_merge: 5, min_entries_to_merge_wait_minutes: 5, max_entries_to_build: 5, check_response_timeout_minutes: 60, grouping_strategy: ALLGREEN)
• Also tightening the pull_request rule's allowed_merge_methods to ["merge"] only, to match actual repo settings

The tag ruleset ("Release gate") needs no changes — merge queue only affects how commits land on main, not tag pushes, and since this repo is merge-commit-only, PR SHAs aren't rewritten so there's no risk to the tag ruleset's assumptions.

Test plan

• Confirm each modified workflow still passes on a normal PR run (unaffected event types)
• After the branch ruleset is updated with the merge_queue rule, verify a real merge-queue run: required checks fire under merge_group, docker-publish.yml's Build & Push job completes without attempting a spurious GHCR push/attest

🤖 Generated with Claude Code

https://claude.ai/code/session_01CS1Q91UoPppSFQ3ZiwFSuT

[coopernetes]

Abandoning, this adds a doubling of wait time for CI (it has to run twice on any PR in the merge queue). Since this project is still mostly single PR at a time, this is too much cost for too little benefit (batching dependabot PRs). Closing.