ci: publish doublezero client docker image on release

[armcconnell]

Summary of Changes

• Add release.docker.client.yml, which builds and publishes the thin client image to ghcr.io/<owner>/doublezero.
• Release path: chained off a successful releaser.client run (which publishes the client deb to Cloudsmith) via workflow_run, so the image build never races ahead of the apt package it installs. It resolves the released version from the client/v*.*.* tag and pushes :<version> and :latest.
• Validation path: on PRs touching client/Dockerfile, the entrypoint, or this workflow, it builds the image for linux/amd64 without pushing, to catch Dockerfile/entrypoint regressions before a release.
• Pushes to GHCR with the built-in GITHUB_TOKEN (no extra secrets), mirroring release.docker.core.yml.

This completes the publish half of the thin client image added in #3862.

Diff Breakdown

Category	Files	Lines (+/-)	Net
CI/build	1	+104 / -0	+104
Total	1	+104 / -0	+104

A single additive CI workflow; no application code touched.

Key files (click to expand)

• .github/workflows/release.docker.client.yml — workflow_run publish job (resolves version from tag, pushes :version/:latest) plus a push-free pull_request build job for validation.

Testing Verification

• Workflow passes actionlint (clean) and parses as valid YAML.
• The image build itself was validated out-of-band: built from client/Dockerfile and run on a clean Ubuntu 24.04 amd64 host, where the daemon starts and doublezero status reports correctly.
• The pull_request build-only job exercises the build path on this PR. The workflow_run publish path can only fire from the default branch, so it activates after merge (first real run on the next releaser.client release).