test: add container test suites and run them in CI (#111)

Adds structure, compat and feature-gated container test suites (test/run.sh), runs them in CI, and gates image publishing on a green test run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/docker-publish.yml

@@ -21,8 +21,20 @@ env:
 
 
 jobs:
-  build:
+  # Publish gate: the test suite must pass before an image is built and pushed
+  # on master or a release tag. Pull requests already run test.yml directly and
+  # only build here without pushing, so the suite is skipped for them.
+  tests:
+    if: github.event_name != 'pull_request'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/test.yml
 
+  build:
+    needs: tests
+    # A skipped `tests` job (pull requests) would skip `build` as well, hence
+    # the explicit condition. Failed or cancelled tests never publish.
+    if: ${{ !cancelled() && (github.event_name == 'pull_request' || needs.tests.result == 'success') }}
     runs-on: ubuntu-latest
     permissions:
       contents: read