ci(container): automate the Gadi Singularity image builds

[jcgraciosa]

docs/developer/gadi_singularity/ has had no CI since #133 and has only ever been
built by hand. Adds gadi-uw3-image.yml (pushes to main/development, v* tags,
releases) and gadi-petsc-image.yml (only petsc.rhel and petsc-custom/patches/**,
since it is a ~25 min from-source build). Both amd64-only with Docker v2 media types
and attestations off, which is what Gadi's Singularity pulls; names derive from
github.repository_owner so they work in a fork. Each build is smoke-tested, then old
untagged versions are pruned (keeping 3, tagged exempt).

Fixes five pre-existing bugs the automation exposed, none visible when building by hand:

1. underworld3.rhel omitted requests, imported unguarded by utilities/_utils.py
   — import underworld3 raised ModuleNotFoundError.
2. underworld3.rhel:22 lacked a leading #; BuildKit read the comment as an
   instruction (podman continues comments across a trailing backslash).
3. setuptools-scm was missing from the builder, so with --no-build-isolation the
   version never resolved and the image reported 0.0.0.
4. cython>=3.1 was unbounded — petsc4py 3.25.0's PC.pyx:1256 fails under 3.3.0.
   Bisected: 3.2.9 is the last that builds.
5. ARGs re-declared after FROM had no defaults, so PYVER could expand empty.

Also adds ARG UW3_REPO (hardcoded clone URL blocked fork builds) and
ARG PETSC_MAKE_NP, and repoints PETSC_IMAGE off a personal namespace.

Validated: both images build green, and a CI-built image pulls on Gadi and passes a
3-rank compute-node Stokes run matching a baremetal reference to the digit.

Checklist (UW3 Style Charter — docs/developer/UW3_STYLE_CHARTER.md)

• I have read the Style Charter and followed it over the surrounding code (S2)
• No drive-by refactors, renames, or "while I was here" cleanups (S9)
• Bug fixes ship the regression test, written first, with level_* and tier_* markers (S8)
• No hedging names (maybe_ / try_ / do_) and no commented-out code (S3, S4)
• Every exception swallow states its sanctioned failure mode in a comment (S4)
• New data access uses .array / mesh.X.coords — no with ....access(...), no mesh.data (S7)
• Parallel safety considered — np2/np4 checked where swarm/mesh/solver dispatch is touched (S11)
• No pixi.toml / pixi.lock or other dependency changes riding in an unrelated PR
• AI-assisted work carries the attribution line below

S8 unticked: container-build failures, not library bugs, so no tests/test_NNNN_*.py
could have caught them — the smoke-test job is the guard.

Underworld development team with AI support from Claude Code