fix: address review findings on the conventions branch

- ci: reject a manual dispatch with tag "latest"; concurrency group per tag
- Dockerfile: declare GIT_COMMIT after the module download layer
- Makefile: docker-build targets linux/amd64 by default
- patch.go: no shared package-level pointers; main.go: no init()
- tests: assert that merge replaces managed listener content
- docs: flows.md startup section matches main.go; review saved to docs/reviews

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -52,7 +52,8 @@ Reconcile loop (keyed by Certificate):
 6. Patch the Gateway only when `ListenersEqual` reports a difference.
 
 A reverse watch maps Gateway events back to the targeting Certificates through the
-same index, so manual Gateway edits are reverted for `auto-*` listeners.
+same index. Manual edits to `auto-*` listeners are reverted only in the fields
+`ListenersEqual` compares, and only while at least one Certificate targets the Gateway.
 
 Listeners named `auto-{certName}-{dnsName with dots as dashes}` belong to the
 operator. Any other listener is never modified or removed.
@@ -210,9 +211,10 @@ Gitea Actions, workflows in `.gitea/workflows/`:
 - `build.yaml` builds the image and pushes it to
   `gitea.home.hrajfrisbee.cz/kacerr/gatewayapi-certificates-operator` on any tag push
   or manual dispatch with a `tag` input. A `check` job (`go vet`, `go build`,
-  `go test -short`) gates the build. Every build pushes `:<tag>` and an immutable
-  `:sha-<12-char-commit>`; `:latest` moves only on real tag pushes. Needs the
-  `REGISTRY_TOKEN` repo secret.
+  `go test -short`) gates the build; it does not run lint or `-race`, so run
+  `make check` before tagging. Every build pushes `:<tag>` and an immutable
+  `:sha-<12-char-commit>`; `:latest` moves only on real tag pushes, and a dispatch
+  with `tag: latest` is rejected. Needs the `REGISTRY_TOKEN` repo secret.
 - `kubernetes-deploy.yaml` applies `deploy/` to the home-lab cluster through a
   Vault → Kanidm → OIDC auth chain.
 
@@ -255,6 +257,8 @@ Gitea Actions, workflows in `.gitea/workflows/`:
 - **`make lint` pins `GOTOOLCHAIN` to the go.mod version.** golangci-lint cannot
   type-check a standard library newer than the Go it was built with, so running
   `golangci-lint run` directly fails when the host Go is ahead of it.
+- **`make docker-build` builds `linux/amd64`** regardless of the host, because that
+  is what the cluster runs. Override with `PLATFORM=`.
 - **No leader election**; safe only at `replicas: 1`.
 - **Deployment uses the mutable `:latest` tag**, so a new image does not roll out on
   its own.