devops: add CI/CD to build, publish, and deploy the zeeder image

[andres-pcg]

Zeeder needs a CI/CD path so that merging a change produces a verifiable, reproducible image that the fleet can be rolled onto with a single documented command, instead of a hand-built image and a manual deployment.

Requested work

• Build and publish the image from CI, referenced by immutable digest.
• Supply-chain hardening: base images pinned by digest, SBOM, build-provenance attestation, image signing, and GitHub Actions pinned by commit SHA.
• Wire the deploy tooling to consume the published image, pinned by digest.
• Keep the rollout human-controlled: rolling, one host at a time, gated.

Status

Largely delivered by #53 (signed release publishing), #56 (base images pinned by digest), and #58 (git-pinned fleet delivery, ADR 0006). #65 adds a CI-driven roll. Remaining follow-ups are tracked in #55 and #66.

[andres-pcg]

The CI/CD this issue asked for — build, publish, and deploy — is delivered:

Build + publish + supply chain: #53 (signed multi-arch publish with build-provenance, SBOM, and cosign), #56 (base images pinned by digest).

Git-pinned fleet delivery: #58 (ADR 0006) — bumping the pinned image reference is the deploy event, with the git history as the audit trail.

CI-driven, human-gated roll: #65, plus the hardening the first real deploy surfaced — #70 (fail the roll closed when a node can't be probed), #71 (smoke-test the image before it ships), #69/#72/#73/#74 (auth and host-integration fixes). Proven in production: the first node was deployed through the workflow, gated and signature-verified.

Remaining: the full release→deploy chain (cut a release → the auto-opened image-bump PR → merge → roll) has not yet run start to finish. That first end-to-end release is the natural close criterion / final verification.