[codex] add docker validation and publish after ci

[jigarkhwar]

What changed

• Added a multistage Dockerfile that builds galaxio in a Go builder stage and runs it from a distroless nonroot image.
• Added .dockerignore to keep the build context small.
• Wired Docker image validation into ci so the image build starts only after successful test and integration jobs on pull_request.
• Added a separate docker-publish workflow that runs only after ci succeeds on main, rebuilds and validates the image, and then pushes galax-io/galaxio to Docker Hub.
• Kept release.yml tag-only for GitHub Releases via GoReleaser.
• Documented Docker usage in the README.

Why

• PRs should validate the image locally without waiting on release infrastructure.
• Publishing should happen only after CI passes on main.
• Tag pushes should remain responsible for GitHub Releases only.
• The layout follows the distroless Go example and the existing style from galax-io/docker-images.

Impact

• Pull requests verify the image by running the CLI inside the built container.
• main publishes galax-io/galaxio only after a successful ci workflow.
• Git tags still produce GitHub Releases.
• The runtime image stays small and non-root.

Checks

• go test ./...
• go test -tags=integration -race -count=1 ./...
• Local Docker simulation on tag 0.0.0 succeeded: docker build ... and docker run ... version printed galaxio 0.0.0 (...).