ci: run the unit tests; build pull requests, publish only release tags

As libreshop/cms adopted: a test job pipes the source into the image's base
(the Dockerfile's first FROM, node:22-slim) and runs npm test there without
network. The image build needs it and runs for pull requests (build only)
and v* tags (published if PUBLISH_ENABLED). main no longer publishes :main
and :sha-* images; mp pins the shop image by version tag.

Refs libretech/mp#71

README.md

@@ -3,8 +3,8 @@
 Vue/Nuxt-style storefront base.
 
 Part of the [libreshop](https://git.librete.ch/libreshop) toolkit. Image
-published at `git.librete.ch/libreshop/shop` on every push to `main`
-and on `v*` tags.
+published at `git.librete.ch/libreshop/shop` on `v*` tags; pull requests
+build it without publishing.
 
 ## Source
 
@@ -18,6 +18,11 @@ pulls `git.librete.ch/libreshop/shop:<pin>` instead of building locally.
 docker build -t libreshop/shop:dev .
 ```
 
+## Test
+
+`npm test` runs the unit tests in `tests/unit/` on Node 22.6 or later, without
+installing dependencies.
+
 ## Adapter contract
 
 See `docker-entrypoint.sh` and `Dockerfile` for the runtime surface.