Add Docker image build workflow

Triggered via repository_dispatch from the blumo release pipeline.
Downloads pre-built binaries from the release, builds multi-arch
Docker images (amd64/arm64), and pushes to GHCR under this repo's
package namespace.

Author: dnnspaul

.github/workflows/docker.yml

@@ -0,0 +1,103 @@
+# Build and publish multi-arch Docker image to GHCR.
+#
+# Triggered by repository_dispatch from the blumo release workflow
+# after a new CLI release is published. Downloads the pre-built Linux
+# binaries from the release and builds the Docker image.
+
+name: Docker Image
+
+on:
+  repository_dispatch:
+    types: [release-published]
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  docker:
+    name: Build and push Docker image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get version from event
+        id: version
+        run: |
+          VERSION="${{ github.event.client_payload.version }}"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Building Docker image for version: $VERSION"
+
+      - name: Checkout (for Dockerfile)
+        uses: actions/checkout@v6
+
+      - name: Download release binaries
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          mkdir -p build/amd64 build/arm64
+
+          # Download and extract linux/amd64
+          gh release download "$VERSION" --pattern "paperhero_linux_amd64.tar.gz" --dir /tmp
+          tar -xzf /tmp/paperhero_linux_amd64.tar.gz -C build/amd64/
+
+          # Download and extract linux/arm64
+          gh release download "$VERSION" --pattern "paperhero_linux_arm64.tar.gz" --dir /tmp
+          tar -xzf /tmp/paperhero_linux_arm64.tar.gz -C build/arm64/
+
+          # Copy Dockerfile into each context
+          cp Dockerfile build/amd64/
+          cp Dockerfile build/arm64/
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push amd64
+        uses: docker/build-push-action@v6
+        with:
+          context: build/amd64
+          platforms: linux/amd64
+          push: true
+          tags: ghcr.io/blaumedia/paperhero-cli:${{ steps.version.outputs.version }}-amd64
+          labels: |
+            org.opencontainers.image.source=https://github.com/blaumedia/paperhero-cli
+            org.opencontainers.image.description=PaperHero CLI - Document management for humans and AI agents
+            org.opencontainers.image.licenses=MIT
+          provenance: false
+
+      - name: Build and push arm64
+        uses: docker/build-push-action@v6
+        with:
+          context: build/arm64
+          platforms: linux/arm64
+          push: true
+          tags: ghcr.io/blaumedia/paperhero-cli:${{ steps.version.outputs.version }}-arm64
+          labels: |
+            org.opencontainers.image.source=https://github.com/blaumedia/paperhero-cli
+            org.opencontainers.image.description=PaperHero CLI - Document management for humans and AI agents
+            org.opencontainers.image.licenses=MIT
+          provenance: false
+
+      - name: Create and push multi-arch manifest
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          docker manifest create ghcr.io/blaumedia/paperhero-cli:${VERSION} \
+            ghcr.io/blaumedia/paperhero-cli:${VERSION}-amd64 \
+            ghcr.io/blaumedia/paperhero-cli:${VERSION}-arm64
+          docker manifest push ghcr.io/blaumedia/paperhero-cli:${VERSION}
+
+          docker manifest create --amend ghcr.io/blaumedia/paperhero-cli:latest \
+            ghcr.io/blaumedia/paperhero-cli:${VERSION}-amd64 \
+            ghcr.io/blaumedia/paperhero-cli:${VERSION}-arm64
+          docker manifest push ghcr.io/blaumedia/paperhero-cli:latest
+
+          echo "Published:"
+          echo "  ghcr.io/blaumedia/paperhero-cli:${VERSION}"
+          echo "  ghcr.io/blaumedia/paperhero-cli:latest"