feat: add docker-publish reusable workflow

[JustMaris]

Adds docker-publish.yml: builds a multi-arch image (amd64 + arm64 by default), pushes it to GHCR, and attests SLSA provenance next to it. It's a single job.

This replaces three identical copies of build.yml (github-actions-runner-exporter, pve-metrics-exporter, momentarr). With it, action pins and Dependabot bumps happen here once instead of in each repo.

It's meant for cross-compiling Dockerfiles (FROM --platform=$BUILDPLATFORM + GOARCH=$TARGETARCH), where arm64 doesn't go through QEMU. momentarr builds that way in ~1 min; the QEMU builds take ~5 min. Images that can't cross-compile should keep a native per-arch split like nordvpn's, so nordvpn isn't migrated.

• Inputs:
  • image: defaults to ghcr.io/<owner>/<repo>, lowercased
  • context
  • platforms
  • tags: defaults to the callers' current rules (latest on main, long sha, semver)
  • runner
• README section and CLAUDE.md table row added.
• There's no self-test in ci.yml, since it would need to push to a registry (same as go-ci).
• actionlint and zizmor (offline) are clean locally.