feat(ci): build the memoryd image (sovereign, decoupled — memory-mesh owns its build) (#42)

memoryd has a Dockerfile (images/memoryd.Dockerfile) but no CI ever built it → not in GAR, so
prophet-platform can't deploy it (review-env manifest only). This adds the build via the estate's
reusable SocioProphet/.github build-image workflow — same path as prophet-platform/images.yml —
publishing memoryd:sha-<commit> to Artifact Registry + cosign-signing the digest.

Gated on repo secrets GCP_WORKLOAD_IDENTITY_PROVIDER + GCP_SERVICE_ACCOUNT (WIF). Push/dispatch
only (not PR-wired) so it can't go red before those are set. First step of memory-mesh prod deploy;
the prophet-platform ApplicationSet + values follow once the image exists.

Author: mdheller

.github/workflows/images.yml

@@ -0,0 +1,40 @@
+# Build the memoryd image through the estate's reusable build-image workflow: push with the immutable
+# commit-SHA tag (what the prophet-platform Argo ApplicationSet promotes) + cosign-sign the digest.
+# Same path as prophet-platform/.github/workflows/images.yml — memory-mesh owns its own image build
+# (sovereign, decoupled), prophet-platform deploys it.
+#
+# DEPENDS ON repo secrets GCP_WORKLOAD_IDENTITY_PROVIDER + GCP_SERVICE_ACCOUNT (WIF → Artifact Registry).
+# Not wired to PRs (push/dispatch only) so it can't go red before those are provisioned.
+name: images
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'services/memoryd/**'
+      - 'images/memoryd.Dockerfile'
+      - '.github/workflows/images.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write   # WIF auth + cosign keyless signing
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Dockerfile COPYs from the repo root (services/, specs/, adapters/…), so context is '.'.
+          - { image: memoryd, context: ., dockerfile: images/memoryd.Dockerfile }
+    uses: SocioProphet/.github/.github/workflows/build-image.yml@main
+    with:
+      image: ${{ matrix.image }}
+      context: ${{ matrix.context }}
+      dockerfile: ${{ matrix.dockerfile }}
+      registry: us-central1-docker.pkg.dev/socioprophet-platform/socioprophet
+      registry_auth: gar
+    secrets:
+      gcp_wif_provider:    ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+      gcp_service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}