ci: harden release pipeline

[DeusExTaco]

Summary

• split Docker validation from tag-only Docker release publishing
• keep PR and merge queue checks as the correctness gate while avoiding full main-push CI reruns
• route trusted self-hosted work through explicit ci / docker labels and keep fork/Dependabot PRs on GitHub-hosted runners
• publish/sign/verify release images only from v* tags or manual Docker Release dispatches
• keep SBOM/provenance attestations enabled and validate multi-arch index metadata/description before release creation
• strengthen artifact upload and accessibility coverage for failure/cancel debugging

Verification

• pytest tests/unit/test_github_actions_security_contracts.py -q
• make workflow-hygiene
• pytest tests/e2e/test_accessibility.py -q --browser chromium
• make security-check
• git diff --check
• make ci-full

Notes

• Closed PR Release v0.9.8 #33 instead of merging it; v0.9.8 should be recreated from a fresh release branch/tag after this hardening lands.