ci: add GitHub Actions workflow for tests and Docker publish

Runs lint, format check, typecheck, tests, and build on every push/PR.
On pushes to main and version tags, builds and pushes a multi-arch image
(linux/amd64, linux/arm64) to GHCR with semver and sha tags.