fix(ci): gate image publishing on test, lint, and security checks (#99)

[galt-tr]

Summary

Closes #99 (F-041).

build.yml previously published a Docker image to GHCR on every push to main and every v* tag, with no dependency on the GoFortress test/lint/security jobs. A failing test, lint regression, vulnerable dependency (govulncheck), or leaked secret (gitleaks) could ship a release image.

This PR makes image publishing a downstream step gated on a successful GoFortress run:

• build.yml now triggers via workflow_run after GoFortress completes (in addition to pull_request for verification builds and workflow_dispatch).
• New gofortress-gate job runs first; the job only proceeds when github.event.workflow_run.conclusion == 'success'.
• build-and-push declares needs: [get_tag, gofortress-gate], so the GHCR push cannot run unless GoFortress's required gates all passed.
• The publish step now checks out the exact head_sha GoFortress validated, so we never push a different commit than was tested.

Gates required (all run inside GoFortress; verified by workflow_run conclusion)

• code-quality (golangci-lint, yamllint, static analysis, go vet)
• pre-commit
• security (govulncheck, nancy, gitleaks)
• test-magex
• test-suite
• setup, warm-cache

GoFortress's own status-check job already aggregates these and fails the workflow if any required gate fails, which is exactly what workflow_run.conclusion == 'success' reflects.

Approach

A (recommended): keep gating in-repo and visible. The needs: chain is now:

gofortress-gate -> get_tag -> build-and-push

with gofortress-gate only running when the upstream GoFortress workflow's conclusion is success.

Notes / post-merge build behavior

• After merge, push-to-main will no longer directly trigger an image publish. Instead, GoFortress runs on the push, and only on its successful completion does build.yml (via workflow_run) build & publish. Time-to-publish increases by ~the GoFortress duration; this is intentional.
• Tag pushes (v*): GoFortress's own release job already handles GoReleaser/tag releases. Image publishing now also flows through workflow_run; tag-named image tags via workflow_run are out of scope for this PR (workflow_run carries the head SHA, not the tag ref). If tag-named GHCR tags are needed, follow-up by reading the tag from the workflow_run payload or extending fortress-release to publish images.
• PR builds: still run (no publish), unchanged for fast feedback.
• workflow_dispatch: gate still attaches, but operators can dispatch manually; treat as intentional.

Test plan

• Open this PR; confirm build.yml runs the build job (no push) and GoFortress runs in parallel as expected.
• After merge to main, confirm GoFortress runs first and build.yml only fires after GoFortress concludes successfully.
• Confirm a forced GoFortress failure on a follow-up PR/branch prevents build-and-push from running (job is skipped via gofortress-gate if:).
• Confirm GHCR receives an image tagged with the head_sha GoFortress validated.