ci(docker): tag latest in unified release instead of rebuilding (#9500)

The separate container_latest.yml workflow rebuilt the latest image from
scratch on every tag push (full multi-arch build + QEMU + trivy gate),
which is slow and frequently fails — leaving `latest` stranded on the
prior release (e.g. 4.23 after 4.24 shipped, #9497).

Drop the rebuild. The unified release workflow already publishes the
exact same content as `<tag>` and `<tag>_large_disk`, so just re-tag
those manifests with `crane tag` on both GHCR and Docker Hub once
copy-to-dockerhub completes. Seconds, not hours, and no QEMU.

Move the trivy scan into the unified workflow as report-only: SARIF
still uploads to GitHub Security for visibility, but vuln findings
no longer block the release.

container_latest.yml stays as a workflow_dispatch-only manual fallback.

Refs #9497.

.github/workflows/container_latest.yml

@@ -1,9 +1,10 @@
 name: "docker: build latest container"
 
+# Manual fallback only. On tag push, container_release_unified.yml already
+# re-tags the released versioned image as `latest` / `latest_large_disk`,
+# so a full rebuild here is unnecessary. Run this manually if you need to
+# rebuild `latest` from an arbitrary ref.
 on:
-  push:
-    tags:
-      - '*'
   workflow_dispatch:
     inputs:
       source_ref: