ci: publish the runtime image to GHCR - #5

Why

Hosts such as Unraid pull a registry image rather than building locally, and this repo had no workflow that produced one. Follow-up to the four hardening PRs (#1 to #4) from Agent Room AM-PJ5JXM25UMCHU2UFJHXFSWBN9J.

What

• .github/workflows/docker.yml: builds packages/context/Dockerfile and pushes to ghcr.io/teejs/context.
• Every push to main that touches the package refreshes main and a sha-<short> tag. latest and <version> move only when the package version changes, which is the "Version Packages" merge the release workflow publishes from, so the image and the npm release come from the same commit. workflow_dispatch with tag_release forces the release tags.
• No tag trigger on purpose: the release workflow pushes tags with GITHUB_TOKEN, and GitHub never starts another workflow from those pushes.
• Push uses oci-mediatypes=false with provenance and sbom off: Unraid's update check does not accept a bare OCI manifest and trips over attestation entries, and a single-platform buildx push emits exactly that unless told otherwise.
• README documents the image and tags.

After merge

1. The merge itself triggers the first build (main + sha-* tags only).
2. Run the workflow manually with tag_release checked to publish latest and 1.2.4.
3. The GHCR package is private on first push. Set it to public in the package settings, or Unraid cannot pull it without a docker login on the host.
4. Verify the manifest media type with an anonymous token before pointing Unraid at it.

🤖 Generated with Claude Code