Add Docker publish workflow

[victorjudysen]

Summary

• Add a Docker Publish GitHub Actions workflow for the existing Dockerfile
• Build Docker images for pull requests without publishing them
• Publish images to GitHub Container Registry on pushes to main, version tags, and manual runs

Closes #908

Tests

• npx prettier --check .github/workflows/docker-publish.yml
• ruby -e "require 'yaml'; YAML.load_file('.github/workflows/docker-publish.yml'); puts 'valid yaml'"
• git diff --check

Notes

• This was statically validated locally. A real publish run requires GitHub Actions package permissions in the upstream repository.