[codex] Publish registry-backed server images

[den-sq]

Summary

• add a Publish Server Image workflow that builds the Python wheel and publishes python/Dockerfile-prod to GHCR
• tag server images by release tag and commit SHA
• document how release compose files should consume immutable registry image tags while keeping the wheel/Dockerfile path as fallback

Closes #85

Validation

• git -C ouroboros diff --check

Not run

• The GitHub Actions workflow was not executed locally.
• Docker compose/build validation could not run because Docker is unavailable in this WSL distro.