ci: validate and build Docker changes

[aoirint]

Warning

This pull request was created with assistance from LLMs.

Summary

• Split proposed-source and integrated-source validation into event-owned workflows.
• Run checksum-verified hadolint on proposed changes and before the integrated Docker build.
• Publish and test the integrated image before creating an immutable GitHub release, and update eligible Action pins.
• Use numeric runtime UID/GID so the Dockerfile passes the current hadolint policy.

Related Issues

None.

Notes for reviewers

Docker build and release-test jobs use ubuntu-24.04; lightweight lint, planning, and release jobs use ubuntu-slim. The latest eligible releases were reviewed on 2026-08-11. actions/checkout is v7.0.1, docker/login-action is v4.6.0, and hadolint is v2.15.1. The hadolint Linux x86-64 asset is downloaded from the official release and checked against GitHub's published SHA-256 digest c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507 before execution.

Proposed merge attribution

Included: Co-authored-by: Codex <[email protected]>

The pull request creator is the primary author. No additional human attribution candidate was identified.

AI disclosure

Codex designed and implemented the workflow and Dockerfile changes and performed structural and supply-chain review.

Testing

Automated checks

• actionlint -color
• pinact run --check --min-age 7
• hadolint v2.15.1 against Dockerfile after SHA-256 verification
• git diff --check

The full image build and upstream release-test suite are intentionally limited to the integrated main-branch commit because they are large and network-intensive. Pull requests stay within the lightweight lint scope, while main retains the release test against the published image.

AI-assisted inspections

• Request: Review event boundaries, job dependencies, permissions, concurrency, runner selection, external executable pins, artifact lineage, and release ordering.
  • AI-assisted result: PR/merge-queue validation is cancelable and read-only; main validation is uncancelled; publication authority is isolated; release creation depends on the published image passing the existing release-test script.