replace legacy Docker release publishing

[alixander]

Summary

• add a protected-master, manual production Docker publishing workflow using native GitHub-hosted amd64 and arm64 runners
• verify immutable GitHub release inputs, build/push by digest with provenance, run native version/SVG/PNG smokes, and publish exact multi-arch manifests
• enforce Docker Hub version-tag immutability, immutable version tags, explicit stable-only latest promotion, and same-run recovery
• remove the Docker portion of the legacy AWS SSH release path and hard-disable legacy helper publishing
• document the new production procedure and recovery path

Safety

• no production workflow was dispatched and no production Docker tag was changed
• version tags are protected by live Docker Hub scoped immutability plus fail-closed preflight/revalidation
• latest is sourced from the verified immutable version-manifest digest only

Validation

• actionlint v1.7.12 with ShellCheck v0.11.0
• every workflow run: block passed bash -n
• changed shell scripts passed sh -n
• git diff --check
• live read-only GitHub release/tag/asset validation and Docker Hub immutability/Registry HEAD guard tests
• legacy helper publish paths verified to fail with exit 2
• independent threat-model review: no blockers

Known baseline checks

• signed is expected to fail because this agent commit is unsigned
• repository ci is expected to retain the existing TestCLI_E2E/chain_icon_import fixture diff seen on current master
• nofixups is expected to pass