ci(satp-hermes): only push to dockerhub on release

[RafaelAPB]

Pull Request Requirements

• Rebased onto upstream/main branch and squashed into single commit to help maintainers review it more efficiently and to avoid spaghetti git commit graphs that obfuscate which commit did exactly what change, when, and why.
• Have git sign-off at the end of the commit message (Signed-off-by: Name <email>) to certify the Developer Certificate of Origin (DCO). Use the -s flag with git commit. See signing commits for more information. AI agents must not add Signed-off-by tags — only the human submitter may certify the DCO (see AI Guidelines §7).
• Follow the Conventional Commits specification for commit linting.
• If AI tools were used, include an Assisted-by tag in the commit message per the AI Guidelines §2.2 (e.g., Assisted-by: GitHub-Copilot:claude-opus-4). All AI-generated code must be human-reviewed before submission.
• Read and followed the Pull Request Guidelines.

Note: PRs that do not satisfy the requirements above will fail the
DCO checker and/or the commit lint CI checks and cannot be merged.

Character Limit

• Pull Request Title and Commit Subject must not exceed 72 characters (including spaces and special characters).
• Commit Message per line must not exceed 80 characters (including spaces and special characters).

A Must Read for Beginners
For rebasing and squashing, here's a must read guide for beginners.

[sandeepnRES]

Looks good, just minor comment