Add a non-root Docker image for the Shoes binary and publish native amd64 and arm64 images to GHCR on master pushes and published releases. Reuse commit images by digest, gate branch and release tags on container smoke checks, and guard against stale promotions. Include the full license bundle and document configuration, writable state, and image tags.
