Tag-triggered container workflows

[l-monninger]

Summary

The container workflows are beginning to flake under various activity levels. It may be nice to adopt the tagged workflows approach from movement to prevent unnecessary building.

Note

Flakiness is likely to persist here since we are using the movement-runner GHA runner to obtain more disk space, as opposed to the more dynamic and scalable BuildJet runners.

[andygolay]

So, only build the containers when tagged? Sounds good to me. The checks can still always run by default.