chore: add composite action for container pull and cleanup

.github/actions/container-cleanup/action.yml

@@ -0,0 +1,12 @@
+name: Container Cleanup
+description: Remove container and clean up image caches.
+
+runs:
+  using: composite
+  steps:
+    - name: Cleanup container and images
+      shell: bash
+      run: |
+        docker rm -f ${CONTAINER_ID} || true
+        docker image prune -a --force --filter "until=24h"
+        docker system df

.github/actions/container-pull/action.yml

@@ -0,0 +1,40 @@
+name: Container Pull
+description: Login to ECR, get image URI from current workflow artifacts, then pull the image onto host runner.
+
+inputs:
+  aws_region:
+    description: AWS Region for docker image repository
+    required: true
+  aws_account_id:
+    description: AWS Account ID for docker image registry
+    required: true
+  artifact_name:
+    description: Docker image URI that is built and saved as artifact within workflows
+    required: true
+    type: string
+
+runs:
+  using: composite
+  steps:
+
+    - name: ECR login
+      shell: bash
+      run: |
+        aws ecr get-login-password --region ${{ inputs.aws_region }} | docker login --username AWS --password-stdin ${{ inputs.aws_account_id }}.dkr.ecr.${{ inputs.aws_region }}.amazonaws.com
+
+    - name: Download image URI artifact
+      uses: actions/download-artifact@v4
+      with:
+        name: ${{ inputs.artifact_name }}
+
+    - name: Resolve image URI for test
+      shell: bash
+      run: |
+        IMAGE_URI=$(cat image_uri.txt)
+        echo "Resolved image URI: $IMAGE_URI"
+        echo "IMAGE_URI=$IMAGE_URI" >> $GITHUB_ENV
+
+    - name: Pull image
+      shell: bash
+      run: |
+        docker pull $IMAGE_URI

.github/actions/pr-permission-gate/action.yml

@@ -1,5 +1,5 @@
 name: PR Permission Gate
-description: Fails the workflow if the PR sender lacks the required repository permission
+description: Fails the workflow if the PR sender lacks the required repository permission.
 inputs:
   required-level:
     description: Minimum permission level required (read|triage|write|maintain|admin)