[codex] publish release assets and lightweight ghcr image

[johnnyhuy]

Summary

This change makes tagged Skillet releases directly usable without requiring downstream packagers to rebuild artifacts themselves. GitHub releases now receive the compiled sklt binaries, checksum file, and build manifest, and the existing GHCR publish flow now produces a lightweight multi-arch image that runs sklt directly.

Previously, Release Please created GitHub releases but those releases did not include runnable binaries, which made the advertised binary distribution path incomplete and forced package managers to depend on separately rebuilt artifacts. The Docker publish workflow also pushed an image, but the container entrypoint and image structure were not optimized around the sklt command users expect to run.

The root cause was that the build matrix workflow only uploaded internal workflow artifacts, not release assets, and the container image copied both Linux binaries into a single final stage before selecting one at runtime. This update adds a release-only upload job in .github/workflows/build-matrix.yaml, restructures Dockerfile so each architecture copies only its own musl binary into the final image, switches the container entrypoint to sklt, and adds OCI metadata labels in .github/workflows/docker-image.yaml. The README and distribution docs were updated to reflect that GitHub releases and GHCR are now configured distribution channels.

Validation

• mise run ci
• mise run docker-smoke