ci: consolidate workflows into single CI pipeline with job deps

Collapses ci.yml, release-image.yml, and deploy-test.yml from three
parallel push-triggered workflows into one orchestrated pipeline:

- release-image.yml: converted to reusable workflow (workflow_call +
  workflow_dispatch). No longer triggers on push directly.
- deploy-test.yml: deleted, content inlined into ci.yml as the
  docker-deploy-test job with needs: [build].
- ci.yml: adds docker-deploy-test job and release-images job. The
  release-images job calls release-image.yml via uses: and is gated
  to push events on main, so PRs do not publish images.
- check-architecture-guardrails.mjs: updated to enforce the new
  reusable-workflow shape (workflow_call trigger, ci.yml chains
  release-image.yml, main-push gating).

One run per commit, clear Success/Failure status, no wasted image
builds when CI fails.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/check-architecture-guardrails.mjs

@@ -663,8 +663,8 @@ export const rules = [
     file: ".github/workflows/release-image.yml",
     required: [
       {
-        pattern: /push:\s*\n\s*branches:\s*\[main\]/,
-        message: "image releases must build automatically on pushes to main",
+        pattern: /workflow_call:/,
+        message: "release workflow must remain callable as a reusable workflow from ci.yml",
       },
       {
         pattern: /workflow_dispatch:/,
@@ -708,6 +708,14 @@ export const rules = [
         pattern: /run:\s+pnpm db:generate/,
         message: "CI must route Prisma client generation through the workspace env/schema wrapper",
       },
+      {
+        pattern: /uses:\s+\.\/\.github\/workflows\/release-image\.yml/,
+        message: "ci.yml must chain release-image.yml so image builds run after checks pass",
+      },
+      {
+        pattern: /github\.event_name == 'push' && github\.ref == 'refs\/heads\/main'/,
+        message: "release-images job must be gated to main-branch pushes to avoid PR image pushes",
+      },
     ],
     forbidden: [
       {