feat: publish lite and full runtime images

[AstrumBot]

Summary

• split the runtime publishing flow into two image flavors: full and lite
• keep full as the current batteries-included environment and continue publishing it as latest
• make lite omit the heaviest packages such as LibreOffice, the large font packs, and the LaTeX toolchain
• update runtime verification and GitHub Actions so both flavors are built and checked
• document the new image tags and local build commands in the README

Verification

• bash -n verify-runtime.sh
• targeted static verification for flavor-aware Dockerfile, README, and workflow changes
• parsed .github/workflows/docker-image.yml and .github/workflows/docker-verify.yml with Python YAML
• hadolint Dockerfile reports only pre-existing version pinning warnings

Notes

• I could not run an actual local Docker build in this sandbox because docker is not installed here, so runtime build validation is delegated to CI for this PR.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.