latest docker tag is not a stable build

One-sentence description

The latest docker tag should be a stable build.

Why?

The latest docker tag is the last pushed commit to any MR. It is better if latest is the last stable build (last git tag).

Current implementation

The latest docker tag is the last pushed commit.

Suggested implementation

Only push to latest if a git tag is build.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information