ci: build and publish Docker image to GHCR

[seitzbg]

Summary

Adds a GitHub Actions workflow (.github/workflows/docker-publish.yml) that builds the existing Dockerfile and publishes the image to GHCR (ghcr.io/dev-topsoil/slopsoil). There's currently no automated image build, so users have to docker compose build locally — this makes a pullable image available and validates the Dockerfile on every PR.

Behavior

Event	Action	Tags
Pull request	Build only (no push)	—
Push to main	Build + push	:latest, :sha-<short>
Push tag v*.*.*	Build + push	:stable, :X.Y.Z, :X.Y

• :latest tracks main HEAD; :stable tracks the newest release tag.
• Authenticates with the built-in GITHUB_TOKEN — no secrets to configure. Only needs packages: write (declared in the workflow).
• Pull requests (including from forks) build the image to prove the Dockerfile still works but never push, so they need no credentials.
• linux/amd64 only, matching the VA-API / RPM Fusion hardware-accel Dockerfile (arm64 has no equivalent HW-encode path and would only build under slow QEMU emulation).
• Uses GitHub Actions layer caching (type=gha); cache is written only when pushing, since fork PRs can't write to the Actions cache.

Notes for the maintainer

• First publish makes the GHCR package private by default — flip it to public under the repo's Packages settings if you want anonymous docker pull.
• No docker-compose.yml change here; it keeps using build: .. Happy to add an image: pull option in a follow-up if you'd like.
• Lints clean with actionlint.

Test plan

• actionlint clean; YAML validates.
• This PR triggers the workflow's build-only job (no push) — confirms the image builds in CI.

[dev-topsoil]

While I appreciate the PR, I already have some work in flight to build out the CICD system, the git strategy, and release cycles