Align source-container builds and image publication with the release contract

[Vonng]

Summary

The source Dockerfile and make docker path are not equivalent to the official GoReleaser image:

• base images use mutable tags;
• frontend install is not immutable;
• build_version and build_time arguments passed by Make are not consumed;
• the resulting binary reports (dev);
• the tag workflow can push latest while the GitHub release is still a draft;
• anonymous access to existing GHCR Console tags currently returns 403.

Acceptance criteria

• Decide and document whether GHCR images are public release artifacts.
• Pin build stages by digest or another reviewed immutable mechanism.
• Use yarn install --immutable.
• Inject the same version/commit/time contract as GoReleaser.
• Add an equivalence test for source-built and release-built binaries/assets.
• Treat creation of the release tag as the explicit approval boundary, or delay latest until the draft is published.
• Verify anonymous pull behavior when public distribution is intended.
• Prevent a failed/draft release from advancing latest.

[Vonng]

The official Console image is docker.io/pgsty/silo-console on Docker Hub. PR #58 updates the build defaults, publishing and promotion workflows, CLI hints and release documentation to that registry.

The source/build contract is included in v2.4.1, published from 1360e26d976d82eda395b0b2e449df8c9d49f39c: pinned build images, immutable frontend installation, consistent source-container metadata, frontend equivalence checks and reproducibility gates. The release-source CI matrix passed.

For Docker Hub publication of this existing release, the new workflow verifies the original signed checksum manifest and exact-source provenance, then packages the unchanged Linux amd64/arm64 binaries. Local verification passed for both platforms, including runtime version output and byte-for-byte equality with the signed binary downloads. The tag and binary/package/source assets remain unchanged; the image receives its own signature, SBOM and provenance binding the packaging workflow to the original release inputs.

The separate promotion workflow accepts only the current published stable release and requires image signatures, SBOM attestations, provenance and anonymous pulls for both platforms before updating latest.

Remaining delivery steps: merge PR #58 after its full CI matrix passes, configure the Console repository's DOCKERHUB_USERNAME / DOCKERHUB_TOKEN with push access to the public Docker Hub repository, then publish and verify v2.4.1 and latest. This issue remains open until those public-delivery checks pass.