ci: skip multi-arch manifest publish when push is disabled

[fallintoplace]

Summary

• skip the multi-arch manifest job when push_on_build is false

Why

The per-arch image builds already honor push_on_build through the build output settings, but the final manifest job still runs unconditionally.

That leaves us with an inconsistent flow in non-push contexts: the workflow can skip pushing the arch images and then still try to create and push a multi-arch manifest that references images that were never published.

This showed up after the CI workflow split introduced push_on_build into the modular workflows, but the manifest job never started consuming that signal.

Validation

• git diff --check
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/image-builds.yaml")'

I did not run the workflow end-to-end locally.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.