Add workflow to publish container

[kdvalin]

This PR adds a GitHub workflow to publish container images when a git tag is pushed (can be triggered via GitHub releases as well).

There are also non-pushing builds that occur on PRs and on pushes to main. This is to ensure that the Containerfile never becomes stale.

Required before merge

• quay.io/yossiovadia/llm-katan must be created
• Credentials for this repo will need to be provided in this repo's secrets, using QUAY_USERNAME and QUAY_PASSWORD

[yossiovadia]

Nice follow-up — this is exactly what we discussed. Multi-platform builds, GHA caching, build-only on PRs, push on tags. Clean.

Two things before merge:

1. permissions: write-all is too broad — this gives the workflow full write access to everything (issues, PRs, deployments, secrets, etc.). Should be scoped to just what's needed:

   permissions:
     contents: read
     packages: write

2. Missing newline at end of file — add one after the last line.

Optional nit: add name: Release at the top so it shows up readable in the Actions tab instead of the filename.

I'll set up the quay.io repo and add the secrets on my end.

[kdvalin]

permissons have been removed, was a hold-over from testing using GitHub's ghcr.io registry.

Other feedback addressed, newline at end of file, and a name has been added to the workflow.