Split GHCR read and push credentials

[shiny-code-bot]

Summary

• split GHCR credential resolution for base-image reads and artifact-image pushes
• cache GHCR docker logins by purpose so a read login cannot suppress the later push login
• document publish-time credential roles and add regression coverage

Verification

• python3 -m py_compile odoo_devkit/local_runtime.py
• uv run python -m unittest discover -s tests
• uv run ruff check odoo_devkit/local_runtime.py tests/test_runtime.py
• uv run ruff format --check odoo_devkit/local_runtime.py tests/test_runtime.py
• npx --yes markdownlint-cli2 docs/tooling/workspace-cli.md