fix: address review findings on the conventions branch

- ci: reject a manual dispatch with tag "latest"; concurrency group per tag
- Dockerfile: declare GIT_COMMIT after the module download layer
- Makefile: docker-build targets linux/amd64 by default
- patch.go: no shared package-level pointers; main.go: no init()
- tests: assert that merge replaces managed listener content
- docs: flows.md startup section matches main.go; review saved to docs/reviews

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -1,7 +1,6 @@
 FROM golang:1.25 AS builder
 ARG TARGETOS
 ARG TARGETARCH
-ARG GIT_COMMIT=unknown
 
 WORKDIR /workspace
 COPY go.mod go.sum ./
@@ -11,7 +10,9 @@ RUN go mod download
 COPY . .
 
 # The build context has no .git, so Go's automatic VCS stamp is absent here;
-# the commit comes in through GIT_COMMIT instead.
+# the commit comes in through GIT_COMMIT instead. Declared this late so a new
+# commit does not invalidate the module-download layer.
+ARG GIT_COMMIT=unknown
 RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH:-amd64} go build \
     -trimpath \
     -ldflags "-s -w -X gitea.home.hrajfrisbee.cz/kacerr/gatewayapi-certificates-operator/internal/version.Commit=${GIT_COMMIT}" \