ci: publish pgvector images to GHCR

[e7h4n]

Summary

• publish native linux/amd64 and linux/arm64 pgvector images to ghcr.io/vm0-ai/pgvector
• tag PostgreSQL 17 bookworm builds as pg17, pg17-bookworm, 0.8.5-pg17, and 0.8.5-pg17-bookworm
• publish only after an approved master update or a manual workflow dispatch
• validate pull requests with an amd64 build that has no package write permission
• reject publishing when the versions in Makefile and Dockerfile diverge

User impact

This creates a vm0-owned GHCR source for the pgvector service image so vm0 CI can stop pulling the service container from Docker Hub. Upstream synchronization remains manual, keeping new upstream code behind review before it reaches CI.

Verification

• resolved pgvector version as 0.8.5 from both Makefile and Dockerfile
• git diff --check
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 .github/workflows/docker-publish.yml
• the PR workflow performs the actual amd64 Docker build

Rollout

Merge this PR first. Its master push will publish the initial multi-arch image. After the GHCR manifest and anonymous pull access are verified, a companion vm0 PR can pin the published digest in the bench-api, test-migrate, and test-api service definitions.