ci: publish selur and vordr images to GHCR (#116)

## What

Adds `.github/workflows/publish-image.yml` — a matrix workflow that
builds and pushes the **selur** and **vordr** container images to
`ghcr.io/hyperpolymath/<service>` on push to `main` (and via
`workflow_dispatch`).

## Why

Part of a cross-repo cleanup of mis-attributed GHCR packages.
`odds-and-sods-package-manager` (OPSM) used to build these images, so
`docker/metadata-action` stamped `org.opencontainers.image.source` with
OPSM and GitHub linked the `selur`/`vordr` packages to the wrong repo.
Publishing them from **stapeln** (their real home) re-points each
package's "Repository source" to `hyperpolymath/stapeln` on the next
push.

## Details

- Matrix builds only `selur` and `vordr`. **cerro-torre** stays
unpublished (source kept here only) and **svalinn** self-publishes from
`hyperpolymath/svalinn`, so neither is in the matrix.
- Each service builds from its own dir context
(`container-stack/<service>`, `file:
container-stack/<service>/Containerfile`) — exactly how
`container-stack-smoke.yml` already builds them, so the Containerfiles
are known-good.
- Actions are SHA-pinned to the estate policy (same pins used elsewhere
in the org), `permissions` are least-privilege (`packages: write` only
on the build job), and build provenance is attested via
`actions/attest-build-provenance`.

> Note: the GHCR package → repo **re-link** itself is a manual one-time
step in the GitHub package settings UI (unlink old source / connect this
repo); this workflow ensures every subsequent push publishes with the
correct source label.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_012kWck3NjBo5orHKAXMHm5W

---
_Generated by [Claude
Code](https://claude.ai/code/session_012kWck3NjBo5orHKAXMHm5W)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/publish-image.yml

@@ -0,0 +1,71 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# Publish stapeln's container images (selur, vordr) to GHCR so that each
+# GHCR package links back to hyperpolymath/stapeln via the
+# org.opencontainers.image.source label injected by docker/metadata-action.
+#
+# cerro-torre and svalinn are intentionally NOT published here:
+#   - cerro-torre stays unpublished (source kept in this repo only)
+#   - svalinn publishes its own image from hyperpolymath/svalinn
+name: Publish Image
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'container-stack/selur/**'
+      - 'container-stack/vordr/**'
+      - '.github/workflows/publish-image.yml'
+  workflow_dispatch: {}
+permissions:
+  contents: read
+jobs:
+  build-push:
+    name: Build ${{ matrix.service }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    strategy:
+      fail-fast: false
+      matrix:
+        service: [selur, vordr]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - name: Log in to GHCR
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        with:
+          images: ghcr.io/hyperpolymath/${{ matrix.service }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha
+      - name: Build and push ${{ matrix.service }}
+        id: push
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v6
+        with:
+          context: container-stack/${{ matrix.service }}
+          file: container-stack/${{ matrix.service }}/Containerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=${{ matrix.service }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.service }}
+      - name: Attest container provenance
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        with:
+          subject-name: ghcr.io/hyperpolymath/${{ matrix.service }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true