feat(release): mirror images to Docker Hub

[vishr]

Summary

• mirror each accepted release manifest from canonical GHCR to Docker Hub without rebuilding
• publish labstack/fanout:<version> and labstack/fanout:latest
• require equal registry digests and anonymous pulls from both registries before creating the GitHub Release
• make Docker Hub the short quick-start image while retaining GHCR for canonical and development images
• document the two-registry release contract

Why

Docker Hub improves docker run discoverability and removes the registry-host prefix from the OSS quick start. Copying the already accepted multi-platform OCI manifest avoids divergent builds and preserves GHCR as the canonical source.

Local verification

• actionlint .github/workflows/release.yml
• just check
• just test-race
• git diff --check
• copied the existing v2026.8.3 manifest with the exact workflow command
• verified GHCR and Docker Hub resolve to the same digest: sha256:3af6481c54408aa3337f7571ea223d23c74bdf897f1e10e0847a90c9d924ceff
• anonymously pulled docker.io/labstack/fanout:2026.8.3 using a fresh Docker config

Release validation

After merge, publish the next CalVer release and require the workflow to prove the mirror, digest equality, and anonymous pulls end to end.