We can stop the merge queue from pushing to the "production" tags (latest, stable etc), and re-tag the merge-queue builds as those prod tags in the push trigger. So:
Merge queue builds all images, pushes to merge-queue only tags
Push trigger re-tags merge queue tags with production tags
Also, we can configure Renovate to group all images together, so it makes one PR for all images in a repo. This can be combined with a timer to merge things after say an hour to catch any straggling builds.
Bazzite could have separate image-versions.yaml files for each DE, and the workflows say "if image-versions.kinoite.yaml is changed, build kinoite images"
This is the sort of thing I did for three years at my last job. Building out solutions to these annoying problems in GitHub and AWS.
Now I teach people why they need to rotate their passwords if they are committed to GitHub, or write reports on why patching a critical server is important