fix(ci): fork-safe cleanup, manual triggers, draft PR skipping

- cleanup: pull_request -> pull_request_target so fork PRs trigger cleanup
- cleanup: add workflow_dispatch for manual stale image deletion
- publish: skip fork PRs (no packages:write) and draft PRs
- publish: add ready_for_review trigger
- publish: add workflow_dispatch for manual fork PR builds
- publish: unified tag derivation step

.github/workflows/on-pr-docker-cleanup.yml

@@ -1,17 +1,23 @@
 name: "[PR] Cleanup Docker preview image"
 
 on:
-  pull_request:
+  pull_request_target:
     types: [closed]
     branches:
       - dev
+  workflow_dispatch:
+    inputs:
+      pr-number:
+        description: "PR number whose preview image to delete"
+        required: true
+        type: number
 
 permissions:
   packages: write
 
 env:
   REGISTRY: ghcr.io
-  IMAGE_TAG: pr-${{ github.event.number }}
+  IMAGE_TAG: pr-${{ github.event.inputs.pr-number || github.event.number }}
 
 jobs:
   delete-image: