ci: run image publish in a separate parallel job

[mnencia]

Neither task depends on the other's output: task ci runs lint, tests, e2e, and docs, while task publish builds and pushes the multi-arch images. Running them as sequential steps in one job only adds their durations. Splitting publish into its own job lets it run alongside ci instead, and lets each job carry only the permissions it actually needs: ci never writes to the registry, and neither task touches repository contents, so only packages: write on the publish job remains.

QEMU is only needed for publish, since it's the only job that builds non-native (arm64) platforms; ci's e2e-ephemeral image build is amd64-only. The disk cleanup steps aren't needed for publish either: it only builds two lean multi-arch images, well within the free disk space available even on the default ubuntu-latest runner.

Note that publishing testing images no longer waits on ci passing, since gating it away would remove the parallelism this is meant to gain.

Note: main's required status checks are currently ["DCO", "ci"]. A failure in the new publish job will no longer block merging a PR, since it isn't in that list (today it does, since publishing is a step inside the required ci job). Flagging for a decision on whether publish should be added as a required check.