fix(ci): gate Docker Hub login without direct secrets expressions

[JSONbored]

Summary

Fixes GitHub Actions startup failures caused by invalid direct secrets.* expressions in workflow conditions and restores Docker Hub publish gating.

What changed

• add a Resolve Docker Hub publish settings step in CI / Sure-AIO publish job
• compute and expose safe step outputs:
  • enabled (true/false based on Docker Hub secret presence)
  • image_name (from DOCKERHUB_IMAGE_NAME, fallback to IMAGE_NAME)
• replace invalid condition:
  • from direct if: ${{ secrets... }} usage
  • to if: ${{ steps.dockerhub.outputs.enabled == 'true' }}
• update tag-computation env wiring to consume resolver outputs instead of direct secret expressions

Why

• merged main workflows failed to parse with:
  • Unrecognized named-value: 'secrets'
• publish pipeline could not start until workflow syntax was corrected
• resolver-based outputs keep Docker Hub behavior optional while remaining valid for workflow parsing

Validation

• workflow file parses correctly after update
• local template validation still passes:
  • python3 scripts/validate-template.py

Notes

• Docker Hub publish remains conditional and only runs when both DOCKERHUB_USERNAME and DOCKERHUB_TOKEN are configured.
• DOCKERHUB_IMAGE_NAME remains supported for namespace override (defaults to jsonbored/sure-aio via IMAGE_NAME fallback).