chore(release): 迁移发布镜像到 GHCR

[ThaddeusJiang]

Summary

• 将 Docker 镜像发布从 Docker Hub 迁移到 GHCR：ghcr.io/thaddeusjiang/vmemo
• 新增 release.yml、release-manual.yml、docker-publish.yml，让 GitHub Release 和手动 prerelease 复用同一套发布流程
• 删除 Docker Hub 描述更新、临时 tag 删除脚本，并同步 README、部署文档和自托管模板
• 新增 decision 007-publish-release-images-to-ghcr，覆盖旧 decision 中的 Docker Hub 结论
• 为 workflow 增加静态 contract test，并将外部 GitHub Actions 固定到 commit SHA

Why

• 按照 save_it 的 release/manual release/docker publish 工作流形状统一发布路径
• 不再依赖 Docker Hub token 和 Docker Hub 包页面
• 保持 no-cache/no-artifact 的仓库级 GitHub Actions 决策

Validation

1. unset MIX_DEPS_PATH; DATABASE_URL=postgres://postgres:postgres@localhost:10001/vmemo_dev TYPESENSE_URL=http://localhost:10002 TYPESENSE_API_KEY=xyz mix compile --warnings-as-errors
2. unset MIX_DEPS_PATH; DATABASE_URL=postgres://postgres:postgres@localhost:10001/vmemo_test TYPESENSE_URL=http://localhost:10002 TYPESENSE_API_KEY=xyz mix test test/vmemo/github_actions_workflows_test.exs
3. ruby -e 'require "yaml"; Dir[".github/workflows/*.yml"].sort.each { |path| YAML.load_file(path); puts "ok #{path}" }'
4. rg -n "uses:\\s+[^\\s]+@(?![0-9a-f]{40}\\s+#\\s+v)" .github/workflows -P || true
5. rg -n "Docker Hub|DockerHub|dockerhub|DOCKERHUB|hub\\.docker\\.com|actions/cache|actions/upload-artifact|actions/download-artifact" .github/workflows || true
6. git diff --check HEAD

RC Status

• release-manual.yml cannot be triggered until this workflow exists on the default branch; GitHub returned workflow ... not found on the default branch when invoked from this PR branch.
• A local linux/arm64 image build from commit 2207cf2 completed, but pushing ghcr.io/thaddeusjiang/vmemo:2026.6.12-rc.1 and :stag requires a token with write:packages scope.
• GHCR push is pending token authorization; no Docker Hub fallback was used.

Notes

• 本地还有一个未提交的 mise.toml 改动，未包含在本 PR。