Please address the comments from this code review:

## Overall Comments
- The image name `ghcr.io/cleanuparr/cleanuparr` is now defined both in the `REGISTRY_IMAGE` env var and hard-coded when constructing `githubTags`; consider switching the tag construction to use `REGISTRY_IMAGE` to avoid duplication and future drift.
- The `push` decision is currently computed inside the shell script using a GitHub expression (`push="${{ github.event_name == 'pull_request' || inputs.push_docker == true }}"`); it would be clearer and less error-prone to derive this as a pure workflow expression (e.g. a job-level output or env) rather than mixing template evaluation with bash.

## Individual Comments

### Comment 1
<location path=".github/workflows/build-docker.yml" line_range="159" />
<code_context>
-        uses: docker/setup-qemu-action@v3
-
       - name: Login to GitHub Container Registry
+        if: needs.prepare.outputs.push == 'true'
         uses: docker/login-action@v3
         with:
</code_context>
<issue_to_address>
**🚨 issue (security):** Pushing images on pull_request events can fail or behave unexpectedly for forked PRs due to restricted GITHUB_TOKEN permissions.

Since `push` resolves to `true` for `pull_request` events, the `build`/`merge` jobs will try to push with the default GITHUB_TOKEN. For forked PRs this token is read‑only, so pushes will fail and can block the workflow. If forked PRs should run this workflow, consider narrowing the `push` condition (e.g. only on `push`/`workflow_dispatch`/internal PRs) or adding a check like `github.event.pull_request.head.repo.full_name == github.repository` before attempting to push.
</issue_to_address>

Please address the comments from this code review:

## Overall Comments
- The `push` flag is now computed inside the shell script via `push="${{ github.event_name == 'pull_request' || inputs.push_docker == true }}"`, which mixes GitHub expressions and bash; consider moving this logic back into the workflow YAML (e.g., as an `outputs` expression) so it remains purely declarative and easier to reason about.
- In the `merge` job, the manifest creation step assumes that `prepare.outputs.tags` is non-empty; it may be worth guarding against an empty or malformed tags string (e.g., all whitespace or leading/trailing commas) to avoid creating a manifest with no valid tags.

## Individual Comments

### Comment 1
<location path=".github/workflows/build-docker.yml" line_range="95-97" />
<code_context>
           githubTags=""
-
           if [ -n "$latestDockerTag" ]; then
             githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$latestDockerTag"
           fi
</code_context>
<issue_to_address>
**suggestion:** Consider using REGISTRY_IMAGE env var instead of hardcoding the image name in multiple places.

`REGISTRY_IMAGE` is defined as `ghcr.io/cleanuparr/cleanuparr`, but this tag construction still hardcodes that value. Referencing `REGISTRY_IMAGE` here (e.g. `"$githubTags,${REGISTRY_IMAGE}:$latestDockerTag"`) avoids duplication and prevents drift if the image name or registry changes.

```suggestion
           if [ -n "$latestDockerTag" ]; then
             githubTags="$githubTags,${REGISTRY_IMAGE}:$latestDockerTag"
           fi
```
</issue_to_address>