fix: address review findings on the conventions branch

- ci: reject a manual dispatch with tag "latest"; concurrency group per tag
- Dockerfile: declare GIT_COMMIT after the module download layer
- Makefile: docker-build targets linux/amd64 by default
- patch.go: no shared package-level pointers; main.go: no init()
- tests: assert that merge replaces managed listener content
- docs: flows.md startup section matches main.go; review saved to docs/reviews

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/gateway/patch.go

@@ -9,11 +9,7 @@ import (
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 )
 
-var (
-	defaultPort       gwapiv1.PortNumber     = 443
-	tlsModeTerminate                         = gwapiv1.TLSModeTerminate
-	namespacesFromAll gwapiv1.FromNamespaces = gwapiv1.NamespacesFromAll
-)
+const defaultPort gwapiv1.PortNumber = 443
 
 // BuildListenersFromCertificates creates the desired set of managed listeners
 // from all annotated Certificate resources targeting a single Gateway.
@@ -43,11 +39,11 @@ func BuildListenersFromCertificates(certs []cmv1.Certificate, prefix string) []g
 				Protocol: gwapiv1.HTTPSProtocolType,
 				AllowedRoutes: &gwapiv1.AllowedRoutes{
 					Namespaces: &gwapiv1.RouteNamespaces{
-						From: &namespacesFromAll,
+						From: ptrTo(gwapiv1.NamespacesFromAll),
 					},
 				},
 				TLS: &gwapiv1.ListenerTLSConfig{
-					Mode: &tlsModeTerminate,
+					Mode: ptrTo(gwapiv1.TLSModeTerminate),
 					CertificateRefs: []gwapiv1.SecretObjectReference{
 						{
 							Group:     ptrTo(gwapiv1.Group("")),

internal/gateway/patch_test.go

@@ -143,6 +143,9 @@ func TestBuildListenersFromCertificates_listenerFields(t *testing.T) {
 	if ref.Kind == nil || *ref.Kind != "Secret" {
 		t.Errorf("ref kind = %v, want Secret", ref.Kind)
 	}
+	if ref.Group == nil || *ref.Group != "" {
+		t.Errorf("ref group = %v, want the core group", ref.Group)
+	}
 	if l.AllowedRoutes == nil || l.AllowedRoutes.Namespaces == nil ||
 		l.AllowedRoutes.Namespaces.From == nil ||
 		*l.AllowedRoutes.Namespaces.From != gwapiv1.NamespacesFromAll {
@@ -202,6 +205,21 @@ func TestMergeListeners_ownership(t *testing.T) {
 	}
 }
 
+func TestMergeListeners_replacesManagedContent(t *testing.T) {
+	t.Parallel()
+
+	old := listener("auto-web-a-example-com", "a.example.com", "default", "old-tls", 443)
+	desired := listener("auto-web-a-example-com", "a.example.com", "default", "web-tls", 443)
+
+	got := MergeListeners([]gwapiv1.Listener{old}, []gwapiv1.Listener{desired}, testPrefix)
+	if len(got) != 1 {
+		t.Fatalf("got %d listeners, want 1", len(got))
+	}
+	if name := got[0].TLS.CertificateRefs[0].Name; name != "web-tls" {
+		t.Errorf("secret name = %q, want the desired web-tls", name)
+	}
+}
+
 func TestListenersEqual_managedFields(t *testing.T) {
 	t.Parallel()