feat(ci): build-once-promote pattern to eliminate double Docker build

[h0lybyte]

Summary

• Eliminate double Docker build — the pipeline was building the same Docker image twice (~43 min test + ~40 min publish = ~83 min wasted). Now the test job pushes to ghcr.io/<image>:ci-<sha> after e2e passes, and the publish job pulls + retags instead of rebuilding.
• Skip Playwright in Docker build — add PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 to Dockerfile astro-builder stage. Playwright was downloading ~600MB of browsers that are never used inside the build, and frequently timing out.
• Fully backward-compatible — if no CI image exists (e.g. for apps that don't pass image), the publish job falls back to full build.

Changes

File	What
docker-test-app.yml	New image input, packages: write, push CI image after e2e
utils-publish-docker-image.yml	Promote step pulls CI image, gates build steps on promote.found
ci-main.yml	Add image to e2e matrix, pass to test workflow, elevate permissions
apps/kbve/axum-kbve/Dockerfile	PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1

Expected impact

• ~1h 45min → ~1h 05min (publish drops from ~44 min to ~2 min)
• Playwright skip saves additional ~3-5 min on the test build

Test plan

• CI test job pushes ghcr.io/kbve/kbve:ci-<sha> after e2e passes
• Publish job logs "Promoted" instead of running full Nx build
• Final images on DockerHub + GHCR have correct version tags
• Playwright download no longer appears in Docker build logs
• Other Docker apps (discordsh, cryptothrone, etc.) still work with new matrix

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None