fix(ci): publish :testing on every merge to testing branch

publish.yml was only triggered by builds on main and next. Auto-merge
PRs target the testing branch, so their builds completed successfully
but no image was ever published. promote-testing-to-main.yml fires on
push to testing and immediately does skopeo inspect dakota:testing —
this silently failed whenever testing advanced without a prior main
publish.

Fix: add testing and gh-readonly-queue/testing/** to the workflow_run
branches filter, allow testing in the setup job condition, and map the
testing branch to testing_tag=testing. The fast-forward-testing step
in the promote job is already gated on branch==main so there is no
loop.

Result: every merge to testing now publishes :testing immediately,
matching the bluefin/bluefin-lts behaviour.

Assisted-by: Claude Sonnet 4.6 via pi

Author: castrojo

.github/workflows/publish.yml

@@ -10,6 +10,8 @@ on:
       - 'gh-readonly-queue/main/**'
       - next
       - 'gh-readonly-queue/next/**'
+      - testing
+      - 'gh-readonly-queue/testing/**'
 
 env:
   IMAGE_NAME: dakota
@@ -44,7 +46,9 @@ jobs:
        (github.event.workflow_run.head_branch == 'main' ||
         startsWith(github.event.workflow_run.head_branch, 'gh-readonly-queue/main/') ||
         github.event.workflow_run.head_branch == 'next' ||
-        startsWith(github.event.workflow_run.head_branch, 'gh-readonly-queue/next/')))
+        startsWith(github.event.workflow_run.head_branch, 'gh-readonly-queue/next/') ||
+        github.event.workflow_run.head_branch == 'testing' ||
+        startsWith(github.event.workflow_run.head_branch, 'gh-readonly-queue/testing/')))
     steps:
       - name: Resolve build SHA and trigger event
         id: context
@@ -60,12 +64,17 @@ jobs:
           fi
           echo "branch=${BRANCH}" >> "$GITHUB_OUTPUT"
           # Derive the :testing tag from the branch name.
-          # main     → :testing  (stable dev stream)
+          # main     → :testing  (from main via promote job)
+          # testing  → :testing  (direct: every merge to testing publishes immediately)
           # next     → :next     (rolling GNOME master / bleeding edge)
           if [[ "$BRANCH" == "main" || "$BRANCH" == gh-readonly-queue/main/* ]]; then
             echo "testing_tag=testing" >> "$GITHUB_OUTPUT"
           elif [[ "$BRANCH" == "next" || "$BRANCH" == gh-readonly-queue/next/* ]]; then
             echo "testing_tag=next" >> "$GITHUB_OUTPUT"
+          elif [[ "$BRANCH" == "testing" || "$BRANCH" == gh-readonly-queue/testing/* ]]; then
+            # testing branch builds publish :testing directly so every merge to
+            # testing produces a fresh image. Matches bluefin/bluefin-lts behaviour.
+            echo "testing_tag=testing" >> "$GITHUB_OUTPUT"
           else
             # Fallback for any future branches: strip merge-queue prefix
             CLEAN="${BRANCH#gh-readonly-queue/}"
@@ -241,8 +250,8 @@ jobs:
 
   # ── Promote :testing ──────────────────────────────────────────────────────
   # Re-tags :$sha as :testing immediately after a successful publish on any
-  # main or merge-queue build. No e2e gate here — every merged PR ships to
-  # :testing so users always get the latest code.
+  # main, testing, or merge-queue build. No e2e gate here — every merged PR
+  # ships to :testing so users always get the latest code.
   # e2e only gates the weekly :testing → :stable promotion.
   # NVIDIA is continue-on-error so a failing NVIDIA promote does not
   # prevent the default :testing from landing.