feat: publish container images to GHCR alongside Docker Hub

[sbryngelson]

Summary

• Push every container image to both Docker Hub and GitHub Container Registry (GHCR) simultaneously
• Add permissions: packages: write so GITHUB_TOKEN can authenticate to GHCR
• Add OCI org.opencontainers.image.source label linking images back to this repo
• Use imagetools create consistently for all manifest operations (CPU and GPU)
• Simplify manifest steps with a for R in "$DH" "$GH" loop instead of duplicated commands

Why GHCR

• GHCR has no pull rate limits for public repos; Docker Hub throttles anonymous pulls (a real pain on HPC clusters)
• Some institutions block Docker Hub entirely
• Images in GHCR are accessible at ghcr.io/MFlowCode/mfc:<tag>-cpu / ghcr.io/MFlowCode/mfc:<tag>-gpu

Improvements over #1080

• Rebased on the fresh Docker workflow (fix: split CPU docker build into native amd64/arm64 jobs to prevent 6h timeout #1418) with NVHPC 24.5, ARM compiler path fix, and --gpu acc
• Stays on build-push-action@v5 for GPU jobs (v6 caused SIGTERM in dry-run)
• latest-* tags remain gated to release events only (not nightly)
• Consistent imagetools throughout — no docker manifest create/push mixing
• No Homebrew changes (already merged in fix: inline Fortran constant defaults in _fc() to prevent Homebrew sync failures #1419)

Closes #1080

[qodo-code-review]

ⓘ You've reached your Qodo monthly free-tier limit. Reviews pause until next month — upgrade your plan to continue now, or link your paid account if you already have one.