Add CA bundle to scratch image; support tag suffix for rebuilds

- Grafana (GF_SERVER_ENFORCE_DOMAIN=true) 301-redirects API calls to the
  canonical https:// domain; Go TLS verification of the redirected request
  needs a CA bundle, which scratch lacks. Copy ca-certificates.crt into
  the final image.
- workflow_dispatch gains a 'suffix' input so the same upstream version
  can be rebuilt under a new tag (v1.1.0-1) without mutating v1.1.0.

Dockerfile

@@ -27,7 +27,10 @@ ARG MCP_GRAFANA_VERSION
 ARG TARGETARCH
 
 # curl + tar + coreutils (sha256sum/grep) to fetch and verify the pinned
-# upstream release. ca-certificates for HTTPS to github.com.
+# upstream release. ca-certificates for HTTPS to github.com — and the CA
+# bundle is copied into the final scratch image too, because Grafana
+# (GF_SERVER_ENFORCE_DOMAIN=true) redirects API calls to its canonical
+# https:// domain and Go's TLS verification needs the bundle.
 RUN apk add --no-cache curl tar coreutils ca-certificates
 
 WORKDIR /tmp
@@ -49,8 +52,11 @@ RUN set -eux; \
     chmod +x mcp-grafana
 
 # The binary is fully static (no INTERP segment) — scratch is sufficient.
+# The CA bundle is copied in for TLS verification of redirected Grafana
+# requests (Grafana enforces its canonical https:// domain).
 FROM scratch
 
+COPY --from=fetch /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=fetch /tmp/mcp-grafana /mcp-grafana
 
 EXPOSE 3000