ci: modernize Docker image supply chain

[enwaiax]

Summary

Modernizes the Docker image supply chain without publishing any image as part of this PR.

Safe pull-request validation

• detects affected project directories and builds only those images;
• builds AMD64 through Buildx without Docker Hub credentials or registry pushes;
• validates all four projects when the supply-chain workflow itself changes;
• adds Hadolint and Compose parsing to repository validation.

Controlled manual publishing

• replaces arbitrary project path input with a fixed project choice;
• defaults to a multi-architecture dry run (publish: false);
• validates project, platform set, and optional Docker tag;
• logs into Docker Hub only for an explicit publish run;
• publishes latest, immutable sha-<commit>, and an optional tag;
• enables per-project GHA cache, provenance, and SBOM on published images;
• verifies AMD64 and ARM64 in the published manifest;
• updates Docker Hub descriptions only after a successful publish.

Maintenance

• upgrades to current Node 24 compatible GitHub/Docker Actions;
• fixes two Dockerfile parser/lint warnings;
• documents the build and release procedure.

Verification

• all four project Dockerfiles pass docker buildx build --check with no warnings;
• all four projects completed a local AMD64 image build;
• Maddy ARM64 progressed successfully under QEMU through dependency installation and into Go compilation; the local bounded run was stopped by the 10-minute harness limit, not a build error;
• workflow files pass actionlint;
• Hadolint passes at error threshold (legacy Maddy ADD is explicitly tolerated until its submodule build context is redesigned);
• available Compose files pass docker compose config -q;
• documentation link check passes.

Publishing impact

This PR does not publish or overwrite Docker Hub tags. Publishing remains a separate manual action and defaults to disabled.