fix: detect actual docker image tag from docker load output
The push step assumed the loaded image tag matches RELEASE_CABAL_VERSION, but the nix-built image embeds the compile-time cabal version which may differ. Parse the actual tag from docker load output instead.