fix: address review findings on the conventions branch

- ci: reject a manual dispatch with tag "latest"; concurrency group per tag
- Dockerfile: declare GIT_COMMIT after the module download layer
- Makefile: docker-build targets linux/amd64 by default
- patch.go: no shared package-level pointers; main.go: no init()
- tests: assert that merge replaces managed listener content
- docs: flows.md startup section matches main.go; review saved to docs/reviews

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/build.yaml

@@ -4,15 +4,14 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Image tag'
+        description: 'Image tag (not "latest")'
         required: true
-        default: 'latest'
   push:
     tags:
       - '*'
 
 concurrency:
-  group: build-${{ github.ref }}
+  group: build-${{ github.ref }}-${{ inputs.tag }}
   cancel-in-progress: true
 
 jobs:
@@ -45,6 +44,11 @@ jobs:
         run: |
           if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
             TAG="${{ inputs.tag }}"
+            # The Deployment runs :latest; only real tag pushes may move it.
+            if [ "$TAG" = "latest" ]; then
+              echo "refusing to dispatch with tag 'latest'" >&2
+              exit 1
+            fi
           else
             TAG="${{ github.ref_name }}"
           fi