v1: a v1 release moves the GHCR image's latest tag to v1 #2958

Problem

A v1 release moves the GHCR image's latest tag to the v1 image. After the 1.0.5 release (run 43105007317), ghcr.io/modelcontextprotocol/inspector:latest and :1.0.5 resolve to the same digest, sha256:59726800…6a73, while :2.14.0 is sha256:3d2834aa…eb66. So docker pull ghcr.io/modelcontextprotocol/inspector now gets deprecated v1.

npm is unaffected: publish-all pins --tag v1-latest, and npm latest is still 2.14.0. GHCR has no equivalent guard.

Cause

publish-github-container-registry in v1/main's .github/workflows/main.yml runs docker/metadata-action@v6 with only images: set. On a tag event its default flavor: latest=auto adds latest next to the version tag. 1.0.4 almost certainly did the same; 2.14.0 was released 27 minutes later and took latest back, so nobody noticed.

Fix

Add flavor: latest=false to the Extract metadata step. The version tag (type=ref,event=tag) is unchanged; only the automatic latest goes away.

The latest tag itself has to be pointed back at 2.14.0 by hand (docker buildx imagetools create -t …:latest …:2.14.0). That's a registry operation, not part of this change.

No milestone: every milestone is a v2 release bucket.