- Push to main builds ARM64 image and deploys to docfast-staging namespace - Push a version tag (v*) promotes latest image to docfast namespace (prod) - Both use same deployer SA with namespace-scoped RBAC
