ci: add optimized Docker publish workflow (closes #281)

[anuragg-saxenaa]

Rebased cleanly on current master. Resolves the merge conflicts in the original PR #305.

What this adds

• Triggers on v* tag push and workflow_dispatch only — no noise on every commit
• amd64 only — drops arm64, halves build time
• Registry-based layer cache via ghcr.io — fast warm builds
• Disabled provenance/SBOM attestations — saves ~30s per build
• NEXT_TELEMETRY_DISABLED=1 baked in
• Dependabot config for weekly GitHub Actions version bumps

Closes #281