feat: manual on-demand Docker image build workflow for PRs

[Copilot]

Maintainers had no way to build and share a Docker image from a contributor PR without merging to main first, blocking real-user pre-merge testing.

New workflow: ci-pr-build-docker.yml

Adds a workflow_dispatch-only workflow (no automatic triggers) that a maintainer can invoke from the Actions tab with a PR number as input.

Steps:

• Checks out refs/pull/{pr_number}/head — works for fork PRs where GITHUB_TOKEN permissions would otherwise block automatic builds
• Captures the actual PR HEAD SHA via git rev-parse HEAD (avoids github.sha which resolves to the default branch in workflow_dispatch context)
• Builds multi-platform image (linux/amd64, linux/arm64) and pushes to GHCR tagged ghcr.io/mandarons/icloud-docker:pr-{N}
• Posts a PR comment with pull/run instructions, image digest, and the exact commit SHA built

Permissions scoped to job:

permissions:
  contents: read
  packages: write
  pull-requests: write

The run command in the comment includes the /home/abc/.local volume mount for keyring/session persistence, matching documented container usage.

Based on the commented-out build-and-push-docker job in ci-pr-test.yml, extracted into a standalone manually-triggered workflow.

[Copilot]

Pull request overview

Adds a maintainer-invoked GitHub Actions workflow to build and publish a Docker image for a specified PR, enabling pre-merge testing by pulling a PR-scoped image from GHCR.

Changes:

• Introduces a workflow_dispatch-only workflow that checks out refs/pull/{N}/head for a provided PR number.
• Builds and pushes a multi-arch (linux/amd64, linux/arm64) image tagged ghcr.io/<owner>/<repo>:pr-{N}.
• Posts a PR comment with pull/run instructions, image digest, and the exact PR HEAD SHA that was built.