[CI] Add Woodpecker shadow pipeline (build + push, dry-run)

[uz1mani]

Summary

• Adds .woodpecker/build.yml and .woodpecker/push.yml for the Woodpecker CI shadow phase, running alongside the existing GitHub Actions workflow (unchanged).
• Mirrors build-and-push.yml's branch routing: main -> ciphera-net/pulse-frontend, staging -> ciphera-net/pulse-frontend-staging, each with its own Vault-sourced NEXT_PUBLIC_* build args (namespaced per-branch as Woodpecker repo secrets).
• build.yml runs dry_run: true with shadow-<sha7> / shadow-staging-<sha7> tags; push.yml depends on build and pushes the same shadow tags to the registry for verification.
• No deploy.yml yet, and no Nomad job changes — this phase only proves out build/push in Woodpecker. Deploy + main-only extras (SRI hashing, Exoscale script upload, Bunny purge) land in a later flip phase.

Changes

• .woodpecker/build.yml: write-npmrc step (org npm_token secret) + branch-gated build/build-staging step pair using plugin-docker-buildx:6.1.1.
• .woodpecker/push.yml: same npmrc + branch-gated push/push-staging step pair, depends_on: [build].

Test Plan

• Merge and confirm build + push run dry-run/push successfully on main
• Push to staging and confirm build-staging + push-staging run successfully
• Verify shadow-tagged manifests appear in the registry for both paths
• Soak: 3 green runs on main, 1 green run on staging