ci(buf): only sync top-level release tags to BSR

[Kybxd]

Problem

This repo tags releases at two levels:

• top-level: vX.Y.Z (the library / proto module release).
• submodule: cmd/tableauc/vX.Y.Z (consumed by release.yml to build
  the tableauc binary archives).

The previous buf-ci.yml had an unfiltered push: trigger, so every
pushed tag, including cmd/tableauc/vX.Y.Z, ran bufbuild/buf-action
and ended up on BSR as a separate tag. buf-action itself has no
tag-name filter, so this had to be solved at the workflow trigger layer.

Fix

Use a tag whitelist on the push trigger so only top-level release
tags reach buf-action:

on:
  push:
    branches: ['**']
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'
      - 'v[0-9]+.[0-9]+.[0-9]+-*'

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf CI / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Jun 1, 2026, 3:29 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.87%. Comparing base (6863556) to head (9487c51).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #412   +/-   ##
=======================================
  Coverage   74.87%   74.87%           
=======================================
  Files          88       88           
  Lines        9384     9384           
=======================================
  Hits         7026     7026           
  Misses       1785     1785           
  Partials      573      573           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.