ci: keep prereleases off the latest tag

`release: published` fires for prereleases too, and every manifest job pushed
`latest` unconditionally, so publishing a release candidate by hand would have
made it the image everyone pulls. The backend image had the same hole, so fix
all three rather than only the two added here.

A release the backend-release workflow calls is always stable, so the
workflow_call path keeps moving `latest`; the release-event path moves it only
when the release is not a prerelease.

.github/workflows/sandbox-image.yml

@@ -38,8 +38,10 @@ permissions:
 env:
   # The version being published, or `develop` for a push to main.
   RELEASE_TAG: ${{ inputs.version || github.event.release.tag_name || 'develop' }}
-  # A release also moves `latest`; a push to main moves nothing but `develop`.
-  MOVING_TAG: ${{ (inputs.version || github.event.release.tag_name) && 'latest' || '' }}
+  # A stable release also moves `latest`. A push to main moves nothing but
+  # `develop`, and a prerelease published by hand moves only its own tag: the
+  # release trigger fires for those too, and they must not become `latest`.
+  MOVING_TAG: ${{ (inputs.version || (github.event.release.tag_name && !github.event.release.prerelease)) && 'latest' || '' }}
 
 jobs:
   build: