ci: publish a dev integration image on every push to main (#1343)

Add docker-dev.yml: on each push to main (and manual dispatch) it builds
the multi-arch image, runs the same Trivy and smoke-test gates as the
release build, and pushes ghcr.io/studio-saelix/sencho-dev with the tags
:dev (moving) and :dev-<short-sha> (immutable), so a maintainer can pull
and test the exact artifact queued for the next release before it can
become a public release.

The integration path is GHCR-only and non-promotable: no Docker Hub, no
latest/semver tags, no cosign signing, no SBOM/VEX, and no GitHub Release.
All of that stays release-only in docker-publish.yml, driven by v* tags.
Least-privilege permissions (contents:read, packages:write) and no
production environment, so dev images publish automatically with no
Docker Hub credentials in scope.

Also add a clarifying header comment to docker-publish.yml noting it is
the release-only path.

.github/workflows/docker-publish.yml

@@ -1,5 +1,10 @@
 name: Build and Publish Docker Image
 
+# Release-only path: fires on v* tag pushes and publishes the public release
+# (Docker Hub + GHCR, latest/semver/moving-minor, SBOM, cosign, GitHub Release).
+# Integration images for pre-release testing are built on every push to main by
+# docker-dev.yml and published as ghcr.io/studio-saelix/sencho-dev:dev; nothing
+# here runs for those. Keep release artifacts out of the dev path and vice versa.
 on:
   push:
     tags: