Refactor the 4 trigger workflows to call a shared _ci-common.yaml
(hadolint + build-test), like web/mydl:
- pr.yaml -> PR checks via _ci-common (concurrency group, dispatch)
- main.yaml -> CI + cached load-build + git semver tag (PAT)
- tag.yaml -> CI + build/push :vX.Y.Z and :vX.Y.Z-latest
- cron.yaml -> nightly rebuild of :vX.Y.Z-latest
- _ci-common.yaml -> hadolint (step-level continue-on-error) + build-test
with GHA cache, load:true and tests/test.sh actually run
(real HTTP smoke tests - they existed but were never
invoked by any workflow)
Fixes: main.yaml tag job had a corrupted remote URL line; tests never ran
on any trigger path.
