ci: publish reusable base image cache

[plexoos]

This PR makes the Docker base stage a first-class CI artifact and uses it to speed up both CI
image builds and devcontainer startup.

The new base-image workflow publishes versioned base images to GHCR, exports BuildKit registry
caches for those base variants, and maintains the default ghcr.io/bnlnpps/simphony:base alias used
by the devcontainer.

• Add build-push-base.yaml to build and publish the Dockerfile base target for supported CUDA/Ubuntu/OptiX/Geant4/CMake combinations.
• Export base-stage BuildKit caches to ghcr.io/bnlnpps/simphony-buildcache:<base-variant> with mode=max.
• Refresh base images on:
  • manual workflow dispatch
  • weekly schedule
  • pushes to main that touch base-relevant inputs
• Add pull: true for base builds so scheduled/manual refreshes pick up updated upstream CUDA parent images.
• Add a base alias for the default environment:
  • CUDA 13.0.2
  • Ubuntu 24.04
  • OptiX 9.0.0
  • Geant4 11.4.1
  • CMake 4.2.1
• Update PR, push, and release image workflows to import both:
  • BASE_CACHE_REF for shared base-stage layers
  • CACHE_REF for target-specific develop/release layers
• Switch the default devcontainer to pull ghcr.io/bnlnpps/simphony:base directly for faster startup.
• Document the new published base image variants in the README.

The Dockerfile base stage is the expensive, slow-moving part of the image build. It installs
system dependencies and builds large dependencies such as CLHEP, Geant4, OptiX headers, CMake, and
Python dependencies.

Publishing this stage separately gives CI and developers a stable reusable foundation while keeping
develop and release image builds focused on source changes. This also makes the devcontainer
contract explicit: ghcr.io/bnlnpps/simphony:base is now produced by CI rather than being an
implied or stale tag.

The root devcontainer is optimized for the fast default path by pulling the published base image.

[Copilot]

Pull request overview

This PR makes the Docker base stage a published CI artifact (with BuildKit registry caches) and updates existing CI workflows and the devcontainer to reuse it, reducing rebuild time for both CI and local development.

Changes:

• Add a new build-push-base.yaml workflow to build/push versioned base images and publish mode=max BuildKit registry caches.
• Update PR/push/release image workflows to import both base-stage cache (BASE_CACHE_REF) and target-specific cache (CACHE_REF).
• Switch the default devcontainer to pull ghcr.io/bnlnpps/simphony:base directly and document base variants in the README.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
README.md	Documents the new published base variants alongside existing develop/release tags.
.github/workflows/release.yaml	Imports base-stage cache in release builds via BASE_CACHE_REF.
.github/workflows/build-push.yaml	Imports base-stage cache in push builds via BASE_CACHE_REF.
.github/workflows/build-push-base.yaml	New workflow to publish base images and export registry caches; maintains the :base alias.
.github/workflows/build-pull-request.yaml	Imports base-stage cache for PR builds to reduce rebuild time.
.devcontainer/devcontainer.json	Uses the published :base image directly instead of building the base target locally.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.