ci: mirror published multi-arch images to GHCR #224

[yupoet]

Summary

Implements #224 by adding a mirror stage at the end of the Docker release pipeline: after the multi-architecture manifests are promoted on Docker Hub and their digests verified, the four promoted tags (RELEASE.*, latest, RELEASE.*-distroless, distroless) are copied to ghcr.io/<repository> using docker buildx imagetools create.

Why a mirror stage instead of dual-registry pushes

• Same digests by construction: registry-to-registry manifest copy preserves the exact manifests and blobs, so ghcr.io/pgsty/silo:RELEASE... resolves to the same digest as Docker Hub — the issue's same workflow / same tags / same digests ask, with zero changes to the six build lanes, SBOM generation, or the six existing attestations.
• No new secrets: uses GITHUB_TOKEN with packages: write.
• Divergence guard: every mirrored tag is digest-checked against the just-verified Docker Hub manifest; a mismatched mirror fails the release run.

Notes for reviewers

• Architecture-suffixed staging tags (*-amd64/*-arm64) remain Docker-Hub-only; only the promoted multi-arch tags are mirrored. Happy to mirror those too if preferred.
• Attestations keep their index.docker.io/pgsty/silo subject names; they remain verifiable against the shared digests by passing the Docker Hub subject registry explicitly. If GHCR-native attestation subjects are wanted later, that would be an additional actions/attest pair per mirrored subject — out of scope here.
• Not runnable end-to-end without maintainer dispatch, so the workflow changes are validated for YAML correctness and staged conservatively after all existing gates.