ci: publish downstream image to GHCR

[constbogdan]

Summary

• add a downstream-owned GHCR publisher for protected downstream-main
• publish immutable full-SHA and rolling downstream tags
• build linux/amd64 with the existing Seerr Dockerfile
• report the published digest and run identity in the workflow summary
• update the workflow inventory and downstream maintenance documentation

Security boundary

Publication requires the exact constbogdan/seerr repository and
refs/heads/downstream-main ref. The workflow has only contents: read and
packages: write permissions.

It does not publish to Docker Hub, run for PRs/tags/manual dispatches, create
GitHub Releases, or modify inherited upstream workflows.

Validation

• all workflow YAML parses
• workflow inventory matches
• Prettier passes
• all inherited workflow files remain identical to upstream/develop
• git diff --check passes