Add a Docker continuity test

[alixander]

What

Adds a manually dispatched, stage-only Docker continuity test that validates an existing published release, builds and smoke-tests amd64 and arm64 images on native GitHub runners, pushes by digest, and combines them into a run-scoped test tag.

Safety

• Never writes a release-version tag or latest.
• Leaves the legacy Docker release path unchanged.
• Uses only GitHub-owned actions.
• Reads Docker Hub credentials from the protected docker-release environment.
• Logs out in always() cleanup steps.
• Uses explicit timeouts, least-privilege permissions, and concurrency control.

Validation

• YAML parsed successfully.
• Every shell block passes bash -n.
• actionlint passes.
• git diff --check passes.
• Release validation tested against published v0.7.1, an invalid version, and a nonexistent release.
• Both exact v0.7.1 Linux release assets downloaded and passed archive validation.

The actual Docker build/push is intentionally not run from this PR. After merge, manually dispatch the workflow from protected master and delete the resulting continuity-test tag after review.