ci(docker): add workflow_dispatch to build a SHA-tagged preview image - #11110

Scanned .github/workflows/docker.yml changes across all 9 CI/CD security passes (triggers, permissions, action pinning, shell injection, checkout, caching, artifacts, release hardening, self-hosted runners) plus lifecycle events and malicious-intent indicators.

Trigger analysis (Pass 1): The PR adds workflow_dispatch alongside the existing push (master-only) and tags (v*) triggers. workflow_dispatch requires write access to the repository and is not triggerable by fork PR authors. The push trigger remains scoped to master. No dangerous triggers (pull_request_target, workflow_run, issue_comment, etc.) are introduced.

Permissions (Pass 2): No changes to the existing permissions: contents: read block. No new grant of write permissions.

Action pinning (Pass 3): No new uses: lines are added. The existing actions/checkout@v7 is pre-existing context, not modified by this PR.

Shell injection (Pass 4): The new Resolve build ref run: block does not interpolate any ${{ }} expressions into shell. All outputs are derived from git rev-parse (validated 40-char / 7-char hex SHAs) and written to $GITHUB_OUTPUT. The echo "Building ${GITHUB_REF} at ${sha}" line uses only shell-safe environment variables (GITHUB_REF and local $sha). No template injection vector.

Checkout (Pass 5): The added ref: ${{ inputs.ref || github.sha }} is inside workflow_dispatch, which requires write access. On push/tag events it correctly resolves to github.sha. actions/checkout validates the ref parameter; arbitrary command injection is not possible. No persist-credentials change.

Caching (Pass 6): No cache-related changes in this PR.

Artifacts (Pass 7): No artifact download/upload changes in this PR.

Release hardening (Pass 8): The PR explicitly prevents manual workflow_dispatch builds from publishing release tags. latest is gated on both default_branch AND event_name != 'workflow_dispatch'. Semver (v*) tags are gated on event_name != 'workflow_dispatch'. The raw sha-<short> tag is used only for manual builds. This is a security-positive change that prevents preview builds from moving release pointers.

Self-hosted runners (Pass 9): No runner configuration changes.

Lifecycle events: No package-manager hooks, build hooks, Docker entrypoints, git hooks, or other lifecycle code was modified.

Malicious intent: No evidence of secret exfiltration, obfuscation, encoded payloads, unexpected network calls, dependency confusion, typosquatting, privilege escalation, credential handling changes, suspicious binary additions, or dangerous eval/exec patterns.