fix(docker): build Clam with clang-16, and validate Dockerfile.dev on PRs

[GuilhermeBn198]

What broke

The Publish Docker Image workflow has failed on develop since #57 merged (run 32551799773). The CI workflow is green — only the image build is red.

/tmp/clam/sea-dsa/lib/seadsa/SeaDsaAnalysis.cc:19:25: error: explicit qualification
in declaration of 'seadsa::TargetLibraryInfoGetter seadsa::mkTLIGetter(...)'
gmake: *** [Makefile:156: all] Error 2

Root cause

sea-dsa defines mkTLIGetter with a redundant seadsa:: qualification inside namespace seadsa. Reproduced both ways in the image:

compiler	result
c++ (GCC 11.4.0, Ubuntu 22.04 default)	error: explicit qualification in declaration
clang++-16	warning: -Wextra-qualification

The Clam RUN was getting GCC because ENV CC=/usr/bin/clang-16 / ENV CXX=... live in section 11 of Dockerfile.dev, 88 lines below the Clam build in section 7b — and a Docker ENV only applies to later instructions. Upstream's own docker/clam.Dockerfile passes -DCMAKE_C_COMPILER=clang-16 -DCMAKE_CXX_COMPILER=clang++-16 explicitly; clang is the toolchain Clam is built against.

This is not upstream drift. seahorn/clam dev16 is at 302bf49a (2026-08-07) and seahorn/sea-dsa dev16 at 661855a3 (2026-08-12) — both older than the recipe that references them. The section never built; it was merged without ever being compiled.

The fix

1. Name the compilers in CLAM_CFG, so the build no longer depends on instruction ordering.
2. Run the publish workflow on pull requests that touch Dockerfile.dev, with push: false.

(2) is the durable half. The workflow only ever ran after a merge to develop, so no PR could have caught an unbuildable Dockerfile — which is exactly how this reached the default development branch. It is paths-filtered, so PRs that don't touch the Dockerfile pay nothing, and GHCR login is skipped on PRs (no packages: write from forks, and nothing to push anyway).

Because this PR touches Dockerfile.dev, the new job builds the image here — the green check on this PR is the validation of the fix, pre-merge.

Why it matters beyond CI

--add-invariants is refused with exit code 3 unless the build ships Clam (#54). Until this image publishes, the Invariants (Clam) CI job stays at CAPABILITY: ABSENT. Merging this is what flips it to PRESENT.

Known follow-up (not in scope here)

Dockerfile.dev clones clam at branch dev16 and Clam's extra target clones sea-dsa/llvm-seahorn at dev16 too — all unpinned moving branches. Not the cause of this failure, but it means a future upstream commit can break the image with no change on our side. Worth pinning to SHAs separately.

Refs #54