[agent] Publish tested Reader images to GHCR

[alexng353]

[agent] Publish the Futurity Reader source build to ghcr.io/futuritywork/reader using full commit SHA tags. The run summary records an immutable digest for explicit deployment; publishing never changes production.

• Pull requests compile the application, build an amd64 container, and run the seven Futurity regressions plus the upstream suite inside that candidate image. Main builds publish only after those checks and a container startup probe pass.
• Use the repository's temporary GitHub token, pin publishing actions, replace Chrome's deprecated apt-key setup, and pin the SearXNG asset that was removed from its moving branch.
• Document package visibility, digest-based rollout, rollback, and upstream updates. The fork uses the image pipeline rather than duplicate inherited coverage jobs; upstream's reusable workflow remains intact.

Validation: actionlint, shell syntax and diff checks pass. GitHub Actions validates the container before publication. Production retains its node-local image.

Co-Authored-By: GPT-6.1 Sol noreply@openai.com