[codex] add api image release workflows

[PerishCode]

Adds API-only GHCR release workflows for mini-packages and expands the restrained local smoke coverage.

Changes:

• add guard, release-beta, and release-stable workflows for the API image
• publish beta/latest plus sha-pinned GHCR tags
• pass build metadata into the API Docker build
• cover token lifecycle, npm/pnpm publish/install, beta/latest dist-tags, and local link workflows in e2e

Validation:

• cargo test --locked
• node --check e2e/scripts/npm-pnpm-smoke.mjs
• docker build ./api
• pnpm -C e2e test