Retag with the HEAD SHA for PR benchmarks

[epompeii]

This changeset retags a PR image with the HEAD SHA for PR benchmarks, instead of the ephemeral merge commit SHA.

[github-actions]

🤖 Claude Code Review

PR: #756
Base: devel
Head: u/ep/pr-head-sha
Commit: 6f04f7dcbbe898362f59bba90698f617e14ffc61

---

PR Review: CI Workflow Changes

Commits: head_sha, rm_cloud_smoke_test, bencher:ci

Changes Summary

1. ci.yml — Skip the release job when running on the cloud branch.
2. test.yml — Change the Docker image tag from registry.bencher.dev/bencher:<sha> to a local bench:ci tag during build.
3. track_benchmarks.yml / track_pr_benchmarks.yml — Add a docker tag step to re-tag bench:ci to the registry name before pushing.

Review

Correctness — looks good. The change decouples the build step from the registry name, tagging locally as bench:ci and only applying the registry tag right before push. This is a clean separation of concerns: the build artifact is portable, and the registry-specific naming happens only in the workflows that actually push.

One minor observation on ci.yml:
The added condition github.ref != 'refs/heads/cloud' skips the release job on the cloud branch. This makes sense given the git flow (cloud is a deploy branch, not a release source), and is consistent with releases being cut from devel/tags.

Security: No new secret exposure. The docker login + docker push pattern is unchanged. The local bench:ci tag never leaves the runner unless explicitly pushed.

No issues found. The changes are minimal, well-scoped, and correct.

---

_{Model: claude-opus-4-6}