fix: address review findings on the conventions branch

- ci: reject a manual dispatch with tag "latest"; concurrency group per tag
- Dockerfile: declare GIT_COMMIT after the module download layer
- Makefile: docker-build targets linux/amd64 by default
- patch.go: no shared package-level pointers; main.go: no init()
- tests: assert that merge replaces managed listener content
- docs: flows.md startup section matches main.go; review saved to docs/reviews

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/gateway/patch_test.go

@@ -143,6 +143,9 @@ func TestBuildListenersFromCertificates_listenerFields(t *testing.T) {
 	if ref.Kind == nil || *ref.Kind != "Secret" {
 		t.Errorf("ref kind = %v, want Secret", ref.Kind)
 	}
+	if ref.Group == nil || *ref.Group != "" {
+		t.Errorf("ref group = %v, want the core group", ref.Group)
+	}
 	if l.AllowedRoutes == nil || l.AllowedRoutes.Namespaces == nil ||
 		l.AllowedRoutes.Namespaces.From == nil ||
 		*l.AllowedRoutes.Namespaces.From != gwapiv1.NamespacesFromAll {
@@ -202,6 +205,21 @@ func TestMergeListeners_ownership(t *testing.T) {
 	}
 }
 
+func TestMergeListeners_replacesManagedContent(t *testing.T) {
+	t.Parallel()
+
+	old := listener("auto-web-a-example-com", "a.example.com", "default", "old-tls", 443)
+	desired := listener("auto-web-a-example-com", "a.example.com", "default", "web-tls", 443)
+
+	got := MergeListeners([]gwapiv1.Listener{old}, []gwapiv1.Listener{desired}, testPrefix)
+	if len(got) != 1 {
+		t.Fatalf("got %d listeners, want 1", len(got))
+	}
+	if name := got[0].TLS.CertificateRefs[0].Name; name != "web-tls" {
+		t.Errorf("secret name = %q, want the desired web-tls", name)
+	}
+}
+
 func TestListenersEqual_managedFields(t *testing.T) {
 	t.Parallel()