PE hyperstack: publish ghcr image on every main push

[KailasMahavarkar]

Makes ghcr.io/orkait/hyperstack always serve the latest. Installs pull :main, but :main was going stale.

Root cause

publish.yml gated the Docker build + push on version-is-new. So the image only rebuilt on the exact push where the version tag flipped - any other main merge left :main pointing at an old build. The 1.1.0 image was never pushed (the #111 run was verify-only, 52s).

Fix

Step	Before	After
Create GitHub release	gated on new version	unchanged (still new-only)
Login + build + push	gated on new version	runs on every main push
Tags	:main + :sha only	:main, :latest, :<version>, :sha

Now every merge to main refreshes :main and :latest; :<version> lets users pin a release. Actions are already enabled, so this self-heals - merging this PR triggers the workflow and produces the 1.1.0 image.

Follow-up (one-time, needs packages admin)

After the first push, set the GHCR package orkait/hyperstack visibility to Public so anonymous docker pull :main works for installers (Settings -> Packages, or API with write:packages).

Verification

python3 -c "import yaml; yaml.safe_load(...)" passes; only the release-create step remains version-gated.