Verify CI steps on main when a new release isn't being created

[spkane]

• We always push containers on a PR, but we shouldn't push new containers on main without a release, since that will push unreleased code under the :latest tag. Or we should pick a special tag for these :unreleased and not overwrite :latest, which should probably be latest stable.
• We should also only run UPX if we actually built the binaries, which we only do on a release.

[tammersaleh]

I was just thinking how it might be useful to have binaries produced for every commit, but pushed to the unreleased (or some sort of other track) on github. Same for docker images. What do you think?

[spkane]

I have thought about this. It would be easier with the containers, then the binaries, since we are using Github releases to distribute the binaries, but there are likely a few ways we could solve this, so it is worth thinking about some more.