Stop running the full pipeline on documentation commits

A README change was building a multi-arch Docker image. Both workflows now
ignore markdown, docs/, demo/, .gitignore and LICENSE. providers/*.json is
deliberately not ignored: CI fails if one stops parsing, which is the one data
change that can break a running gateway.

arm64 is cross-built under QEMU and dominates the Docker job, so it is now only
built for tagged releases; main and PRs build native amd64 only. QEMU setup is
skipped entirely when it is not needed.

Anchors would have kept the paths-ignore lists DRY, but Actions has been
unreliable with them and a broken workflow costs more than five duplicated
lines.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/docker.yml

@@ -4,7 +4,19 @@ on:
   push:
     branches: [main]
     tags: ['v*.*.*']
+    paths-ignore:
+      - '**/*.md'
+      - 'docs/**'
+      - 'demo/**'
+      - '.gitignore'
+      - 'LICENSE'
   pull_request:
+    paths-ignore:
+      - '**/*.md'
+      - 'docs/**'
+      - 'demo/**'
+      - '.gitignore'
+      - 'LICENSE'
   workflow_dispatch:
 
 env:
@@ -29,6 +41,8 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Set up QEMU
+        # Only needed to cross-build arm64, which only tagged releases do.
+        if: startsWith(github.ref, 'refs/tags/')
         uses: docker/setup-qemu-action@v3
 
       - name: Set up Buildx
@@ -65,7 +79,9 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
+          # Multi-arch on releases; native-only otherwise, since emulating
+          # arm64 is most of the build time and nothing consumes it per-commit.
+          platforms: ${{ startsWith(github.ref, 'refs/tags/') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}