ci(publish): dispatch full image-lane smoke after GHCR push

[PipDscvr]

Summary

After publish-core-docker.yml pushes a new GHCR tag, this dispatches a repository_dispatch: core-image-published event so a downstream environment can run the full release-required integration suite against the just-pushed image. Adds coverage for MCP, framework adapters, host-tools E2E, hygiene, and docs-contract on top of the existing in-workflow ingest/search smoke.

Fires only after a fresh push (retag_latest_only=false); a retag of an already-validated digest is skipped.

Wiring

The downstream listener and its preflight live elsewhere; this PR is the sender only. Repository configuration required before the dispatch can succeed:

• Secret IMAGE_SMOKE_DISPATCH_TOKEN — fine-grained PAT with actions: write on the target repo.
• Variable IMAGE_SMOKE_REPO — owner/name of the listener.

The workflow file does not hardcode either value; both are pulled from repo settings. If either is unset the step exits non-zero with a clear error so a missed dispatch is loud, not silent.

Payload

event_type: core-image-published
client_payload:
  core_version: <x.y.z>
  image_ref:    ghcr.io/atomicstrata/atomicmemory-core:<x.y.z>
  image_digest: sha256:...

The digest is read from docker manifest inspect after the push so the listener can pin to a specific image content if it wants to.

Test plan

• pnpm run repo-hygiene passes.
• pnpm run security-compliance passes.
• Workflow YAML parses cleanly with the new step appended at the end.
• First publish after merge dispatches successfully (visible in repo Actions → workflow runs).
• Listener receives the event and the full smoke runs against the new image.