[AARUSHGAUR]

Fixes #192.

Adds a release-triggered workflow that publishes the Docker image so the notebooks and scripts can be used without building locally.

What it does:

• Runs on release: published, and also on workflow_dispatch (with an optional tag input) so the publish path can be exercised manually.
• Publishes to the GitHub Container Registry as ghcr.io/google/sbsim, tagged with the release version (1.2.3, 1.2) and latest. GHCR uses the workflow's built-in GITHUB_TOKEN, so this path works as soon as the workflow is merged, with no new repository secrets.
• Additionally publishes to Docker Hub as <username>/sbsim when the DOCKER_HUB_USERNAME and DOCKER_HUB_PASSWORD repository secrets are set, as described in the issue. That step is skipped when the secrets are absent, so the workflow stays green until the secrets are configured.
• Uses the same action pins and type=gha cache layout as the existing Docker Build workflow.
• Documents the published image in the README (docker pull ghcr.io/google/sbsim:latest).

Testing:

• actionlint .github/workflows/docker-publish.yaml passes.
• YAML parses and the event/tag expressions were checked against the metadata-action tag matrix.
• I could not acceptance-test the Docker Hub push without credentials; once the repo secrets are in place, the workflow can be run from the Actions tab via workflow_dispatch to verify the push end to end. If you would rather keep this GHCR-only, I am happy to drop the Docker Hub steps.

[s2t2]

thanks @AARUSHGAUR for this contribution. I have some minor comments

[s2t2]

could we please move this content into docs/setup/docker.

We can re-organize that file to have two top level sections: build from docker registry (implemented in this PR), and build yourself locally (current content)

[s2t2]

Let's please add some instructions in the docs related to this workflow, or comments at the top of this file, to instruct administrators about what repo secrets and env vars are required by this workflow, and how an admin could set them up, including links to how to docker registry, as applicable.

[AARUSHGAUR]

Thanks @s2t2, I've addressed both review comments.

Docker documentation

• Moved Docker-specific content out of README.md into
  docs/setup/docker.md; the README now links to that guide.
• Reorganized the guide into two top-level sections: Run the Published Image
  and Build the Image Locally. The existing prerequisites, build, run,
  exec, cleanup, and troubleshooting content is retained under the local-build
  section.
• Documented the actual image name (ghcr.io/google/sbsim), platform
  (linux/amd64), tags (latest, the release tag, and semver 1.2.3 / 1.2),
  Jupyter port, and the requirement to authenticate when the package is
  private.

Publish workflow

• Added top-of-file administrator documentation covering required vs optional
  credentials, GITHUB_TOKEN with packages: write, the optional
  DOCKER_HUB_USERNAME / DOCKER_HUB_PASSWORD secrets, workflow environment
  variables, GHCR package visibility, and links to the official GHCR, Docker Hub
  access-token, and GitHub secrets documentation.
• The Docker Hub login/metadata/build steps now require both secrets and are
  skipped when either is unset.
• Release tags are now published directly (type=ref,event=tag), so non-semver
  release tags such as pre-sync-20250521 work in addition to semver tags and
  latest.
• Manual runs use the supplied tag input or sha-<short sha>, matching the
  input description.
• Pinned image builds to linux/amd64 and set persist-credentials: false;
  permissions remain contents: read plus packages: write.

Verification

• mdformat README.md docs --check passes.
• actionlint .github/workflows/docker-publish.yaml passes.
• zizmor .github/workflows/docker-publish.yaml reports no findings.
• YAML parses; internal anchors and links were checked; added external links
  return HTTP 200. No secrets were added.
• No Python code changed, so Python tests/lint were not run locally; this
  environment does not have the project's Python 3.11 / TensorFlow setup.

CI

• The macOS 15 Intel failure is pre-existing and environmental: Homebrew fails
  to link openssl@3 because of an openssl@1.1 conflict in "Install system
  dependencies (on Mac)". The same failure occurs on an unrelated branch run
  (35486179504, job 111937248979), so this PR did not introduce it.
• The new Python CI run for d3a3007 is currently action_required
  (awaiting maintainer approval), so there are no fresh Python CI results yet.
  zizmor and check-changes passed.
• I also merged the current copybara_push branch and let mdformat reflow the
  newly added contributor paragraph; that accounts for the whitespace-only
  README diff.