Draft: ci: only run container jobs when needed

This gets rid of 24 no-op jobs (which still take ~2min each of CPU time) in the critical path of the extremely common "pipelines which do not re-generate a new CI image", allowing build jobs to use that CPU time for something useful instead.

Draft because it depends on !25252 (merged), otherwise pipelines in forks will be broken every time an image tag gets merged upstream.

Draft because there are issues; see first comment.