Fix pipeling to run jobs at the correct times

have jobs with .rules:merge-requests also run on merged result on the default branch.

also add rule, .rules:merge-requests-only to run .cleanup_images only on merge requests, so that the images are not removed on the default branch. in cases of disaster recovery, we may want to go back to the original images that were built in staging.