feat: add release workflow with Docker github-builder

[strayer]

Summary

• Adds a tag-triggered (v*) release workflow using Docker's official github-builder reusable workflow
• Builds multi-arch images (linux/amd64, linux/arm64) and pushes to GHCR with semver tags (1.2.3, 1.2, 1)
• Enables SBOM attestation, OCI metadata annotations/labels, and OIDC-based signing
• Uses GHA build cache (max mode)

Test plan

• Merge and push a v* tag to verify the workflow triggers and builds successfully
• Verify GHCR image is tagged correctly with semver patterns
• Verify attestation is attached to the image

[Copilot]

Pull request overview

Adds a tag-triggered GitHub Actions release workflow to build and publish multi-arch Docker images to GHCR using Docker’s github-builder reusable workflow.

Changes:

• Introduces a new .github/workflows/release.yaml workflow that triggers on v* tags.
• Builds and pushes linux/amd64 + linux/arm64 images to ghcr.io/${{ github.repository }} with semver-derived tags.
• Enables build cache (GHA), SBOM generation, and metadata annotations/labels via the reusable workflow inputs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.