ci(airgap): mirror local Dockerfile pipeline in GHA with parallelism + caches

Translates the local Dockerfile + airgap-multibuild.sh pipeline into GHA
with one job per logical phase, parallel where the local pipeline is
sequential, and path-specific actions/cache keys so unchanged inputs
hit cache deterministically.

Phases:
  1. setup           install deps, make components, apply pre-snapshot
                     patches, discover versions, package the workspace.
                     Caches: node_modules, /opt/venv, examples.
  2a. build_latest   one Hugo run with all version dirs removed.
                     Cache key: hash(non-version content + layouts + config).
  2b. build_versions matrix of N jobs (one per <product, version>).
                     Cache key per build: hash(version content + layouts +
                     config + version lists). Other versions' content does
                     NOT enter the key — edit one version, only that one
                     rebuilds.
  3. assemble        download all 2a + 2b artifacts, merge into single
                     public/ tree (versions overlay latest, css/scss
                     additive), generate_ndjson.py, gzip static (skip
                     .json/.md per nginx sub_filter design).
  4. docker          minimal Dockerfile.runtime: just nginx + COPY public.
                     Multi-arch (amd64 + arm64), push priv + unpriv.

Cache correctness: every input that affects an output is in the hash.
Editing a version's content invalidates only that version's cache.
Editing layouts invalidates everything. Editing an unrelated section
(non-versioned) invalidates only latest.

Dockerfile and airgap-multibuild.sh untouched — local builds still work.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: EliShteinman