Build Docker on release, not (just) push

[surchs]

Currently we build and push a docker image every time we push to main: https://github.com/neurobagel/bagel-cli/blob/1d4cb5217813cedfbe6d78fcb2821fac72059089/.github/workflows/cd.yml

That only really makes sense for testing builds, not for things we deploy to production (c.f. https://github.com/neurobagel/documentation/wiki/Release-process#what-happens-next-todo).

What we should do is:

• make a second deploy workflow that listens for "release: released" (see here), have that build and tag with release number
• only deploy those explicitly tagged images to production
• release often (so we have nice things running in production), look into https://github.com/containrrr/watchtower or https://www.ansible.com/ (?)

[github-actions]

We want to keep our issues up to date and active. This issue hasn't seen any activity in the last 30 days.
We have applied the _flag:stale label to indicate that this issue should be reviewed again.
When you review, please reread the spec and then apply one of these three options:

• prioritize: apply the flag:schedule label to suggest moving this issue into the backlog now
• close: if the issue is no longer relevant, explain why (give others a chance to reply) and then close.
• archive: sometimes an issue has important information or ideas but we won't work on it soon. In this case
  apply the someday label to show that this won't be prioritized. The stalebot will ignore issues with this
  label in the future. Use sparingly!

[surchs]

This now works: https://github.com/neurobagel/bagel-cli/blob/main/.github/workflows/build_docker_on_release.yml