feat: publish versioned GHCR release bundles

[leonfox28]

Summary

• publish deterministic versioned Docker Compose deployment bundles through GitHub Pre-releases
• build and publish immutable linux/amd64 control, agent, and netd images to GHCR only for strict vX.Y.Z tags
• record image digests and keep source-development builds separate from production installation
• update installation, lifecycle, ADR, and Trellis contracts

Validation

• make check-container-files
• go test -count=1 ./internal/containercontract
• make container-config CONTAINER_IMAGE_TAG=dev
• make container-release-bundle RELEASE_TAG=v0.1.0
• make check-docs
• make lint
• umask 0022 && CI=true make test
• umask 0022 && CI=true make security
• git diff --check
• redacted Gitleaks scan of intended worktree, full history, and release assets
• exact v0.1.0 strongSwan package/source build and release asset/license review

Safety

No host preparation, docker compose up, real-device deployment, or HIL action was performed. v0.1.0 remains a deployment candidate Pre-release; clean-VM evidence is not claimed.