fix(ci): publish container image after CI passes on main

[Ferryx349]

Description

This PR fixes container image publishing after the Cycode security finding on workflow_run.

• Removes standalone publish-container-image.yml (unsafe workflow_run trigger)
• Adds publish-container-image as the final job in checks.yml on push to main
• Uses always() gating: if source changed, lint/build/tests must pass; if not, publish still runs after post-tests
• Adds workflow unit test and CI docs (docs/DEPLOYMENT.md, docs/CI-MIGRATION.md)
• Updates deploy/README.md link to point at the new CI docs

Related Issue

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

• Non-functional change (docs, style, minor refactor)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my code changes.
• I added a changeset, or this is docs-only and I added an empty changeset.
• All new and existing tests passed.

[changeset-bot]

🦋 Changeset detected

Latest commit: f2d33fa

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
nostream	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coveralls]

Coverage is 71.326% — fix/publish-image-push-trigger into main. No base build found for main.