CI: build and push the Docker image to ghcr.io on every main push

ghcr.io/syv-ai/qwen38-27b-rtx3090:latest tracks main, sha-<7> tags are
immutable per commit; weekly cron rebuild picks up base-image fixes. The
Dockerfile is the gate: patch application + verify.sh --install run at
build, so a patch that stops applying fails the build and nothing is
pushed (the GPU checks sit behind the --install flag, which is what makes
a GPU-less runner sufficient). Compose now names the ghcr image so
docker compose pull replaces the 20-minute local build; docker compose
build still produces the same tag. Runner disk is freed first -- the
image is ~9.5 GB.