ci: publish multi-arch Keel images to Docker Hub

Publish the same amd64+arm64 release to keelhq/keel on Docker Hub as
ghcr.io/keel-hq/keel, closing the Docker Hub tag gap behind keel#833,
#840, #834 and the long-standing arm64 gap (#710, #666, #619, #447).

- docker-publish: log into Docker Hub, add keelhq/keel to metadata,
  push per-arch images by digest, and refuse to overwrite a published
  Docker Hub tag (same guard as GHCR).
- docker-manifest: create and verify the multi-arch manifest for both
  registries from the shared per-arch digests.
- Add an env-gated Docker Hub multi-arch check to the release checklist
- Document the tag correspondence (application SemVer tag vs keel-v*
  chart tags) and the manual re-publish procedure for historical tags.

Spec-Ref: helix-specs@d6808620:000419_fix-keel-docker-hub