ci: build under a per-run local tag, untag registry refs only, gate the image push on every test job

scripts/ci/cleanup_job_resources.sh

@@ -10,10 +10,12 @@
 #     network only), plus the containers still attached to those networks;
 #   * containers started from the per-run image refs given as arguments, and
 #     those refs. Per-run refs are names containing "aegis-ci-" (named after the
-#     run id) and immutable ":sha-<commit>" tags;
-#   * for any other ref (shared tags such as :latest, :main, :dev, which a
-#     deployment on the same daemon may use) only the tag is removed. Containers
-#     are never touched, and an image still used by a container simply stays.
+#     run id), such as the local build tag aegis-ci-<run id>-build:<sha>;
+#   * for any other ref (registry tags such as :sha-<12>, :latest, :main, :dev,
+#     which a deployment on the same daemon may use) only the tag is removed.
+#     Containers are never touched, and an image still used by a container simply
+#     stays. Pass registry tags before the per-run ref: the image itself goes away
+#     with its last tag.
 # Everything is best effort (a failing removal never fails the job).
 set -uo pipefail
 
@@ -46,7 +48,7 @@ fi
 
 is_per_run_ref() {
   case "$1" in
-    *aegis-ci-* | *:sha-*) return 0 ;;
+    *aegis-ci-*) return 0 ;;
     *) return 1 ;;
   esac
 }