fix: address review findings on the conventions branch

- ci: reject a manual dispatch with tag "latest"; concurrency group per tag
- Dockerfile: declare GIT_COMMIT after the module download layer
- Makefile: docker-build targets linux/amd64 by default
- patch.go: no shared package-level pointers; main.go: no init()
- tests: assert that merge replaces managed listener content
- docs: flows.md startup section matches main.go; review saved to docs/reviews

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/gateway/patch.go

@@ -9,11 +9,7 @@ import (
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 )
 
-var (
-	defaultPort       gwapiv1.PortNumber     = 443
-	tlsModeTerminate                         = gwapiv1.TLSModeTerminate
-	namespacesFromAll gwapiv1.FromNamespaces = gwapiv1.NamespacesFromAll
-)
+const defaultPort gwapiv1.PortNumber = 443
 
 // BuildListenersFromCertificates creates the desired set of managed listeners
 // from all annotated Certificate resources targeting a single Gateway.
@@ -43,11 +39,11 @@ func BuildListenersFromCertificates(certs []cmv1.Certificate, prefix string) []g
 				Protocol: gwapiv1.HTTPSProtocolType,
 				AllowedRoutes: &gwapiv1.AllowedRoutes{
 					Namespaces: &gwapiv1.RouteNamespaces{
-						From: &namespacesFromAll,
+						From: ptrTo(gwapiv1.NamespacesFromAll),
 					},
 				},
 				TLS: &gwapiv1.ListenerTLSConfig{
-					Mode: &tlsModeTerminate,
+					Mode: ptrTo(gwapiv1.TLSModeTerminate),
 					CertificateRefs: []gwapiv1.SecretObjectReference{
 						{
 							Group:     ptrTo(gwapiv1.Group("")),