ci: publish release container to GitHub Packages

[konard]

Summary

• publish release Docker images to GitHub Container Registry for automatic and manual releases
• grant release jobs packages: write and tag images as latest plus the release version
• preserve crates.io publishing with CARGO_REGISTRY_TOKEN fallback and add a workflow invariant check
• sync Cargo.lock to the current crate version so packaging checks run from a clean tree

Fixes #17

Testing

• cargo fmt --check
• rust-script scripts/check-release-workflow.rs
• cargo clippy --all-targets --all-features
• cargo test --all-features --verbose
• rust-script scripts/check-file-size.rs
• cargo package --list

[konard]

Working session summary

Implemented and pushed the fix to PR #20: #20

What changed:

• Release workflow now publishes Docker images to GHCR for both automatic and manual releases.
• Images are tagged as latest and the release version.
• Release jobs now have packages: write.
• Crates publishing now supports CARGO_REGISTRY_TOKEN with CARGO_TOKEN fallback.
• Added scripts/check-release-workflow.rs to guard the release workflow invariants.
• Added a changelog fragment.
• Synced Cargo.lock to crate version 0.9.0, fixing the CI cargo package --list dirty-tree failure.

Verification:

• Local checks passed: cargo fmt --check, workflow check script, clippy, full tests, file-size check, and cargo package --list.
• Latest CI run 25597034413 passed on commit 4aba912.
• PR is ready for review, not draft.
• Working tree is clean.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.5
• Provider: OpenAI
• Public pricing estimate: $7.445935

📊 Context and tokens usage:

• 229.0K / 1.1M (22%) input tokens, 11.2K / 128K (9%) output tokens

Total: (229.0K + 4.7M cached) input tokens, 11.2K output tokens, $7.445935 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.5
• Model: GPT-5.5 (gpt-5.5)

📎 Log file uploaded as Gist (19659KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

✅ Ready to merge

This pull request is now ready to be merged:

• All CI checks have passed
• No merge conflicts
• No pending changes

---

Monitored by hive-mind with --auto-restart-until-mergeable flag