feat(ci): publish omnigraph-server container image to GHCR on release (#340)

* feat(ci): publish omnigraph-server container image to GHCR on release

Build binaries inside a rust:1-bookworm container (matching the
Dockerfile's bookworm-slim runtime glibc) with the aws feature enabled,
then build and push ghcr.io/<owner>/omnigraph-server:<tag>. Separate
from release.yml so an image failure never blocks the binary release,
and a workflow_dispatch backfill of a past tag never re-runs the release
matrix or repoints :latest.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* review fixes: validate dispatch tag (existing v* only), document workflow + GHCR image

- Guard workflow_dispatch: the free-form tag input must name an EXISTING
  v* tag (gh api ref check) and checkout is pinned to refs/tags/<tag>,
  so a branch/SHA can never be published under a release-looking image
  tag (greptile P1).
- docs/dev/ci.md: add the publish-image.yml entry (same-PR docs rule).
- docs/user/deployment.md: document pulling the prebuilt GHCR image.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

docs/user/deployment.md

@@ -172,7 +172,14 @@ endpoint and credentials. CI exercises this path against containerized RustFS.
 
 ## Container Deployment
 
-Build the image:
+Pull the prebuilt public image (published to GHCR for every `v*` release by
+`publish-image.yml`; built with the `aws` feature, linux/amd64):
+
+```bash
+docker pull ghcr.io/modernrelay/omnigraph-server:v0.8.1
+```
+
+Or build it yourself:
 
 ```bash
 docker build -t omnigraph-server:local .