feat(ci): notify orchestrator after image pushes for near-instant catalog sync

[Tjemmmic]

Summary

• Adds a notify-orchestrator job that calls the orchestrator's
  POST /catalog/notify-update endpoint after all images are built and pushed
• Reduces image staleness window from ~20 minutes (periodic sync) to ~30 seconds
  (next host-agent heartbeat)
• Gracefully skips notification if secrets aren't configured yet

Details

The job runs after all leaf build jobs complete and only fires if at least one
build succeeded. Uses always() && !cancelled() so it isn't blocked by skipped
jobs (e.g. empty dynamic matrices).

Required secrets

Before this has any effect, add these to the repo (Settings → Secrets → Actions):

• ORCHESTRATOR_ADMIN_URL — admin API base URL (port 4096)
• ORCHESTRATOR_ADMIN_API_KEY — the orchestrator's admin API key

[shekohex]

@Tjemmmic Have you added these secrets to the repo?

[shekohex]

Ok, I did that.