feat: workspace image runtime and GHCR publishing

[jo-cube]

Summary

Adds the first-release workspace image setup:

• root workspace image module with code, platform, and full as the main published flavors
• Docker Buildx Bake based build graph
• local Compose runtime via just start <flavor> and just up <flavor>
• enterprise overlay template under templates/enterprise
• validation scripts and operational docs
• GitHub Actions for CI, GHCR release publishing, and patch-branch test images

Release behavior

• Stable tags like v1.0.0 publish multi-arch images for code, platform, and full
• Pre-release tags like v1.0.0-rc.1 publish exact prerelease tags only
• patch/** branches publish patch/test image tags only
• Build cache is stored separately in ghcr.io/jo-cube/workspace-cache

Validation

Locally validated:

• just --list
• docker buildx bake --print all
• cached just build full
• isolated just start full
• /health, /status, /code/, /lab
• just doctor
• enterprise template bake/start checks
• workflow YAML parse checks
• CI-style bake print checks