Three workflows besides deploy-docs.yaml (DOCS-124) self-reference in
their paths: triggers. Audit and either justify or remove per DOCS-129:

* docker-base.yaml: keep. Self-reference is PR-only and gated by
  push: ${{ github.event_name != 'pull_request' }} on the build, so
  PRs build the base image without publishing. Documented inline.

* docs-ci.yaml: remove. Self-reference fires the workflow but the
  lint and fmt steps gate on tj-actions/changed-files matching
  docs/** or **.md, so a workflow-only run no-ops. The self-trigger
  was wasted runner minutes. actionlint and make lint/actions catch
  YAML problems before merge regardless.

* dogfood.yaml: keep. Self-reference triggers image rebuild on push
  to main (idempotent retag of rolling tags) and terraform apply
  against dev.coder.com (no-op when dogfood/** and flake.* haven't
  changed). The runtime cost validates the workflow itself end to
  end. Documented inline.

Refs DOCS-121, DOCS-129.

Address DEREM-1..4 on #25288:

* dogfood.yaml: correct "no-op" framing. Workflow-only pushes do create
  three new coderd_template versions on dev.coder.com (name = commit
  short SHA, message = commit title, content unchanged) and retag the
  rolling :latest, :22.04, :26.04, :nix image tags. Idempotent and
  bounded to the dogfood environment, but not a no-op.

* docs-ci.yaml: rewrite the comment to describe what actually changed
  rather than the pre-PR behavior in present conditional tense. Also
  add a one-liner under pull_request: pointing at the push: comment so
  the rationale for the missing self-reference is visible from both
  trigger blocks.

* docker-base.yaml: clarify "PR runs build but never publish" to "a PR
  builds the image but never publishes it".

No behavior change; comment edits only.

Refs DOCS-129.

…vs main effects

Address DEREM-6 and DEREM-7 on #25288:

* DEREM-6: my rolling-tag list named ':latest, :22.04, :26.04, :nix'.
  There is no ':nix' tag on codercom/oss-dogfood; nix is the matrix
  entry name and publishes separately to codercom/oss-dogfood-nix:latest.
  I also missed codercom/oss-dogfood-vscode-coder:latest entirely.
  Replaced the list with an accurate per-repository enumeration of
  rolling tags.

* DEREM-7: my comment described push-to-main effects (terraform apply,
  template-version creation, rolling tag retag) as if they applied to
  any workflow run. They don't. PR runs build images without pushing
  (depot/build-push-action's push: gated on refs/heads/main) and run
  terraform init + validate only (deploy_template's apply step gated
  the same way). Split the comment into a 'PRs' block and a 'Pushes
  to main' block so a maintainer reading either trigger gets the
  correct cost picture.

No behavior change; comment edits only.

…and verb

Address coder-agents-review round 3 findings on PR #25288:

- DEREM-9: the extra tag beyond rolling tags is per-branch (derived
  from `tj-actions/branch-names` current_branch, with `/`->`--`
  substitution), not per-SHA. On pushes to main the resulting tag is
  `codercom/oss-dogfood:main` (overwritten each push), not a
  short-SHA tag.
- DEREM-10: "moved" carries a git-mv connotation. The comment
  describes content change, not a file move, so use "changed".

_Coder Agents on behalf of @nickvigilante._

…comment

Address coder-agents-review R4 DEREM-11 nit: "three image variants"
undercounts. The matrix has three entries (22.04, 26.04, nix), but
the 22.04 entry builds two images (`oss-dogfood` at line 134 and
`oss-dogfood-vscode-coder` at line 160). That's four distinct images
across three matrix entries.

Drop the count rather than enumerate ("four images across three
matrix entries"); the detailed listing immediately below already
names every repo and tag.

_Coder Agents on behalf of @nickvigilante._