Publish hardened Postgres runtime (#9)

[AntoineToussaint]

Closes #9.

Summary

• Replace the vulnerable pgvector base with a reproducible PostgreSQL 17 Alpine runtime while preserving pgvector and the stock entrypoint contract.
• Lock agent, CI, and releases to one immutable AMD64/ARM64 manifest so the tested and scanned bytes are the bytes consumers run.
• Restrict package-write permissions to image publication and pin every reusable workflow/action involved in release handling.

Test plan

• go test ./... -count=1 against the exact locked digest through a local registry
• go vet ./...
• actionlint .github/workflows/ci.yml .github/workflows/releaser.yml
• Produce the same registry digest in two uncached builds using the pinned BuildKit image
• Start the exact image as root and UID 70, create pgvector 0.8.5, and execute a vector-distance query
• Scan Linux/AMD64 and Linux/ARM64 with Trivy at HIGH/CRITICAL severity (0 findings on both)
• Push the locked multi-architecture digest in CI and verify the CI-built digest matches the lock
• Make the existing GHCR package public in Package settings, then rerun CI so its anonymous pull/scan/tag gate completes

Making the existing GHCR package public is an irreversible repository-owner setting change. The package is currently private, and CI therefore stops at the anonymous-consumer check without publishing the human-readable runtime tag.