ci: consolidate workflows into single CI pipeline with job deps

Collapses ci.yml, release-image.yml, and deploy-test.yml from three
parallel push-triggered workflows into one orchestrated pipeline:

- release-image.yml: converted to reusable workflow (workflow_call +
  workflow_dispatch). No longer triggers on push directly.
- deploy-test.yml: deleted, content inlined into ci.yml as the
  docker-deploy-test job with needs: [build].
- ci.yml: adds docker-deploy-test job and release-images job. The
  release-images job calls release-image.yml via uses: and is gated
  to push events on main, so PRs do not publish images.
- check-architecture-guardrails.mjs: updated to enforce the new
  reusable-workflow shape (workflow_call trigger, ci.yml chains
  release-image.yml, main-push gating).

One run per commit, clear Success/Failure status, no wasted image
builds when CI fails.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/release-image.yml

@@ -1,13 +1,19 @@
 name: Release Image
 
+# Reusable workflow: called from ci.yml after all checks pass.
+# Can also be dispatched manually for rebuilds or tag overrides.
 on:
-  push:
-    branches: [main]
-    paths-ignore:
-      - "docs/**"
-      - ".gitea/**"
-      - "**/*.md"
-      - "LICENSE"
+  workflow_call:
+    inputs:
+      image_tag:
+        description: Optional tag override, defaults to sha-<commit>
+        required: false
+        type: string
+    secrets:
+      GHCR_USERNAME:
+        required: true
+      GHCR_TOKEN:
+        required: true
   workflow_dispatch:
     inputs:
       image_tag: