Add manual F1 ECR pilot pinned to workflows PR 238

[nico-ptrs]

Purpose

Exercise the exact approved F1 Docker action code in Venly/venly-github-workflows#238 against an isolated non-production ECR repository before moving v1.

Scope

• Manual dispatch on main with an explicit confirmation string; no ECS deployment.
• Uses the existing RESOURCES_DEPLOY_ROLE secret and verifies shared-resources account 289334807197 plus the dedicated repository before publishing.
• Pins both standard and multi-stage builders to commit 8b75ffb56608ef327ffebf0e7dfc896634528c7f.
• Runs amd64-only and amd64+arm64 cases for each builder; checks immutable digest outputs, child digests, runtime architecture, and candidate-tag cleanup.
• Unique version tags per run and case, with serialized jobs in the isolated repository.

Validation

• actionlint passed.

Gate

Depends on the ECR repository from Venly/aws-cfn-ecr PR (opened in parallel) being reviewed, merged, and manually deployed first. The workflow can be dispatched only after this PR is merged to main. Inspect the four run results and ECR tags before approving merge of Venly/venly-github-workflows#238; no application or ECS task definition changes are included.