ci: publish multi-platform production image to GHCR

[SarthakWade]

Summary

• publish the production container to ghcr.io/lockintime/headless for amd64 and arm64 on version tags
• attach SemVer, source-tag, commit-SHA, and latest references with OCI provenance and an SBOM
• smoke-test the native image before publishing, then log out and require an anonymous pull by digest before creating the GitHub release
• verify the image version, non-root uid, Chromium/FFmpeg runtime, repository linkage, and absence of exposed ports
• document the one-time GHCR public-visibility operation and update release/install guidance

Security

The job uses only GITHUB_TOKEN with job-scoped packages: write. It never opens a port, runs the production image as uid 10001, and fails closed if the published digest is not anonymously readable. GitHub does not expose a supported REST operation for changing package visibility, so the first package publish may require an administrator to mark it public and rerun the failed job.

Validation

• actionlint .github/workflows/release.yml
• shellcheck .github/scripts/container-smoke.sh
• pnpm dlx prettier@3.6.2 --check ...
• native production image build and smoke test
• amd64/arm64 production BuildKit graph
• pnpm test
• pnpm test:runtime
• pnpm test:e2e:linux
• pnpm --filter @headless/web lint
• pnpm --filter @headless/web build
• pnpm --filter @headless/app build
• pnpm test:e2e:mac

Closes #41