CI: Build & Push Docker Images on Tags, Manual ECR Transfer

[macpie]

CI Improvement Overview

This PR overhauls our CI workflows to enable:

• Automatic Docker image build and push to GHCR when pushing a tag.
• A manual ECRPush workflow to selectively pull built images, re-tag them, and push to Amazon ECR.
• Use of ${{ github.ref_name }} as the source tag—only valid when the workflow is manually triggered from a tag, enforced with if: startsWith(github.ref, 'refs/tags/').

Key changes include:

• compute-tag job, which hashes Dockerfile and rust-toolchain.toml to generate a stable image_tag.
• build-base job that pulls the base image if cached, otherwise builds and pushes to GHCR.
• fmt and clippy jobs that run inside the built base image container—this eliminates docker run and caching permission steps.
• tests job now runs inside the base image, with updated service connectivity (e.g., localstack accessible via service name).
• build-image job pushes per-package runner images to GHCR on tag push.
• ECRPush workflow—triggered manually from a tag—to transfer images from GHCR to ECR.

[michaeldjeffrey]

Only gripe is the naming of compute-tag.
When looking at that step I was expecting it to compute the tag for one of our deployable artifact, not only the base image to build everything from.

And just to make sure, we're only expecting that tag to update when we change rust version? Not when we update any deps?...

Maybe compute-base-build-tag

[macpie]

And just to make sure, we're only expecting that tag to update when we change rust version? Not when we update any deps?...

Yes cause it only takes rust-toolchain.toml and Dockerfile