perf(ci): cache docker layers, skip docs-only builds, add GHCR retention

[Exploitacious]

Summary

• Every push has been a cold Docker build (no layer cache), and the GHCR image has never been pruned — it grows unbounded.
• Adds GHA layer cache (type=gha / type=gha,mode=max) to the docker/build-push-action@v7 step, so the npm-install layer gets reused across builds instead of reinstalling every push.
• Adds paths-ignore: ['**.md'] to the push trigger so docs-only commits stop triggering a full rebuild + GHCR push.
• Adds a manual, dry-run-by-default ghcr-cleanup.yml workflow (workflow_dispatch only, no schedule) using dataaxiom/ghcr-cleanup-action@v1 to prune untagged images and keep the last 10 tagged, excluding latest.

Test plan

• Merge and confirm next main push shows cache hits in the build-push-action logs
• Push a docs-only (.md) commit and confirm the workflow does not run
• Run "GHCR cleanup" manually with dry_run: true and review the preview output before ever running it for real