fix: add hardened runtime container

[imran-siddique]

What changed

• add the missing multi-stage CA2A runtime Dockerfile
• build a wheel and dependency wheelhouse in the builder, then install offline in the runtime stage
• run as dedicated UID/GID 10001 with no home directory
• exclude VCS, local environments, tests, docs, examples, and build output from context
• add an unprivileged pull-request image-build job with read-only repository permission
• keep registry login, push, keyless signing, and provenance attestation exclusively in the tag job
• pin every third-party container action to an immutable commit
• document a read-only rootless invocation and hardware-device permission expectations

Why

The tag workflow attempted to publish an image from the repository root, but no Dockerfile existed, so the public container release could not succeed. The workflow also referenced mutable action tags and had no PR build gate. A single job would have granted package/OIDC/attestation permissions even while validating pull requests.

Impact

Pull requests now prove the actual image builds without write or signing privileges. Tagged releases retain version + latest tags, digest signing, and SLSA provenance. The runtime process is non-root; deployments must grant its UID/GID explicit access to any TEE device.

Validation

• container workflow/hardening tests: 5 passed
• full suite: 394 passed, 3 skipped (hardware-only)
• Ruff check and format gate
• mypy strict
• Bandit
• git diff --check
• local Docker is unavailable; this PR intentionally triggers the real GitHub Actions BuildKit build