ci: publish orchestrator + agent container images to GHCR on push to main

Builds both the orchestrator image (Dockerfile.orchestrator) and the agent
runtime image (Dockerfile.runtime) on every push to main, publishes them
as public packages to ghcr.io/stainlu, and tags with both `latest` and
`sha-<commit-sha>` for rollback.

Multi-arch (linux/amd64 + linux/arm64) via QEMU + buildx, so the same
images work on Hetzner CAX11 (ARM Ampere), Lightsail medium_3_0 (Intel
x86), and any other cloud VPS we target. GHA cache (mode=max) speeds up
subsequent builds by reusing intermediate layers across runs.

Motivation: observed deploy time on Lightsail burstable disks was ~12
minutes (dominated by a 6.5-minute `npm install -g openclaw@2026.4.11`
during the agent image build). Pre-built images pulled from GHCR drop
that to ~2-3 minutes. Hetzner deploy time drops from ~4 min to ~1-2 min
for the same reason. This is how every production managed-runtime ships
images — build once in CI, pull everywhere.

Scope of the workflow (deliberately minimal, ~90 lines):
- Trigger: push to main that touches Dockerfiles, package.json, src, or
  the workflow file itself. Also workflow_dispatch for manual runs.
- Matrix strategy with two entries (orchestrator, agent) so both images
  build in parallel on separate runners.
- Uses docker/build-push-action@v6 with type=gha caching.
- `provenance: false` avoids SLSA attestation noise on a project that
  isn't signing releases yet.

After the first successful publish:
- The two packages appear at github.com/stainlu?tab=packages
- Each must be manually flipped to Public via the package settings page
- Deploy scripts can then `docker pull` without auth

Follow-up commits will update docker-compose.yml, scripts/deploy-hetzner.sh,
and scripts/deploy-aws-lightsail.sh to pull these images instead of
building locally on the target VM.

Author: stainlu

.github/workflows/publish-images.yaml

@@ -0,0 +1,94 @@
+name: publish-images
+
+# Builds the orchestrator and agent container images on every push to main
+# and publishes them to GHCR (public). Deploy scripts pull these instead of
+# building from source on the target VM, which cuts end-to-end Lightsail
+# deploy time from ~12 minutes to ~2-3 minutes.
+#
+# Packages land at:
+#   ghcr.io/stainlu/openclaw-managed-runtime-orchestrator:{latest,sha-<sha>}
+#   ghcr.io/stainlu/openclaw-managed-runtime-agent:{latest,sha-<sha>}
+#
+# After the first successful publish, make both packages public in the GitHub
+# UI (user profile -> Packages -> each package -> Package settings ->
+# Change visibility -> Public). Required so deploy scripts can pull without
+# auth.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "Dockerfile.orchestrator"
+      - "Dockerfile.runtime"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "tsconfig.json"
+      - "src/**"
+      - "docker/**"
+      - ".github/workflows/publish-images.yaml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY: ghcr.io
+  OWNER: stainlu
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: orchestrator
+            dockerfile: Dockerfile.orchestrator
+            image: openclaw-managed-runtime-orchestrator
+          - name: agent
+            dockerfile: Dockerfile.runtime
+            image: openclaw-managed-runtime-agent
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.OWNER }}/${{ matrix.image }}
+          tags: |
+            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
+            type=sha,prefix=sha-
+            type=ref,event=branch
+
+      - name: Build and push ${{ matrix.name }}
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=${{ matrix.name }}
+          cache-to: type=gha,scope=${{ matrix.name }},mode=max
+          provenance: false
+
+      - name: Image digest
+        run: echo "${{ matrix.name }} → ${{ steps.meta.outputs.tags }}"