Add Docker image and GHCR workflow

[KaranocaVe]

Summary

• add a production Dockerfile and minimal entrypoint for containerized WireGold runs
• add a dedicated GitHub Actions workflow to build, smoke-test, and publish images to GHCR
• keep Docker builds aligned with the repo's existing Go build flags by preserving -checklinkname=0

Testing

• docker build -t wiregold:test .
• docker run --rm wiregold:test -h
• docker run --rm wiregold:test -g
• docker run --rm wiregold:test -pg
• docker run --rm wiregold:test
• docker run --rm --device /dev/net/tun -v /tmp/wiregold-test:/config wiregold:test
• docker run --rm --device /dev/net/tun --cap-add NET_ADMIN -v /tmp/wiregold-test:/config wiregold:test