ci(rest): re-enable main publish after tag scheme fix

[lachen-nv]

Summary

Re-enables REST publish (docker + helm) on main / release / tags. Follow-up to #1922.

Net diff vs main

Just the tag scheme fix from #1922 (`rest-build-push-service.yml`). The disable toggles introduced in #1922 are reverted back to the original conditional gates.

Merge order

• If ci(rest): disable main publish + fix duplicate SHA in image tag #1922 is merged first: this PR will show only the revert of the two `false` toggles
• If this PR is merged first: it effectively combines ci(rest): disable main publish + fix duplicate SHA in image tag #1922's fix with re-enabling push (skipping the disable step)

Either order is safe. Closing #1922 in favor of this PR is also fine.

Expected after merge

Main pushes will produce clean tags:
```
nvcr.io/0837451325059433/carbide-dev/nico-rest-api:0.11.0-pr-3-g72855901
nvcr.io/0837451325059433/carbide-dev/nico-rest-api:latest
```

And helm chart:
```
nico-rest:0.11.0-pr-3.g72855901
```

[github-actions]

🔐 TruffleHog Secret Scan

✅ No secrets or credentials found!

Your code has been scanned for 700+ types of secrets and credentials. All clear! 🎉

🔗 View scan details

_{🕐 Last updated: 2026-05-25 05:43:20 UTC | Commit: 07c0e4b}

[github-actions]

🔍 Container Scan Summary

Service	Total	Critical	High	Medium	Low	Other
nico-flow	66	4	34	18	2	8
nico-nsm	82	2	28	43	9	0
nico-psm	67	4	35	18	2	8
nico-rest-api	100	6	53	30	3	8
nico-rest-cert-manager	65	4	34	18	1	8
nico-rest-db	66	4	34	18	2	8
nico-rest-site-agent	65	4	34	18	1	8
nico-rest-site-manager	65	4	34	18	1	8
nico-rest-workflow	67	4	35	18	2	8
TOTAL	643	36	321	199	23	64

Per-CVE detail lives in the per-service grype-* artifacts (JSON + SARIF). Severity counts only — no CVE IDs published here.