ci(build): add GHCR image build workflow for exgentic-a2a-runner

[kellyaa]

Summary

• New .github/workflows/build.yaml: multi-arch GHCR image build for exgentic-a2a-runner, modeled after the build.yaml in rossoctl/cortex. Triggers on v* tags, pushes to main, and manual dispatch. Matrix-shaped so future images plug in as extra entries.
• k8s/job.yaml and README repointed to the new image path (ghcr.io/rossoctl/workload-harness/exgentic-a2a-runner).
• New README "Container images" section documents where images publish, how tags map to refs, and how to build locally.

Closes #36.

Notes

• All third-party actions pinned by full commit SHA with version comment, matching cortex convention and OpenSSF Scorecard expectations.
• build-args: is intentionally omitted (runner needs none today) — avoids the dual-key bug in the cortex build-push step where the second build-args key silently drops matrix-level args.
• concurrency cancels superseded builds per ref, but cancel-in-progress is guarded on github.ref_type != tag so tag builds always finish (each tag is a distinct release artifact).
• Image owner is ${{ github.repository }}, which resolves to rossoctl/workload-harness post-rename. The issue text predates the rename and says kagenti/; using github.repository matches the current origin and works with the built-in GITHUB_TOKEN (a token minted for repo rossoctl/* cannot push to ghcr.io/kagenti/*).
• No Cosign / SBOM / provenance in v1 to keep the first PR small — can layer in later.
• After the first successful publish, an org admin will need to make the GHCR package public and link it to this repo.

Test plan

• CI: workflow parses and runs on merge to main — produces main-<sha7> and latest tags
• docker manifest inspect ghcr.io/rossoctl/workload-harness/exgentic-a2a-runner:latest shows both linux/amd64 and linux/arm64
• kubectl apply -f exgentic_a2a_runner/k8s/job.yaml in a smoke deploy pulls the new image successfully
• Tag v0.0.1 push produces :v0.0.1 and updates :latest
• Package visibility flipped to public post-first-publish (org admin action, out of PR scope)

[yoavkatz]

Looks good. I want to test it, but I have general kagenti issues with the new release.