fix(ci): bootstrap the reusable MinIO image in GHCR

[tlongwell-block]

Upstream MinIO image pulls are blocking CI (#7867). Add a separate publisher for ghcr.io/block/buzz-minio:latest, so the reusable image can be bootstrapped before CI adopts it in #7870.

• Build the checksummed official MinIO/mc release binaries from fix(ci): build MinIO from pinned release assets #7868 on a digest-pinned Alpine base.
• Build only when image/workflow/Compose inputs change or on manual dispatch. PRs build and smoke-test; only block/buzz main can publish.
• Run the real Compose healthcheck and initializer, object upload/read/delete, and anonymous-access denial before publishing latest plus a unique sha-<commit>-run-<id>-<attempt> tag.
• Manual dispatch disables Docker's layer cache to refresh Alpine packages. Normal image builds retain caching; each maintenance rebuild keeps its own tag.

Rollout

This PR contains only the publisher and opt-in Compose override. It does not switch ordinary CI consumers, so its checks do not require the unpublished image. This is a separate PR from adoption, as required by Buzz's squash-only merge rules.

1. Merge this PR; its main-branch workflow builds, tests, and publishes the image.
2. Make the buzz-minio GHCR package public and verify an anonymous pull of ghcr.io/block/buzz-minio:latest. New GHCR packages default to private.
3. Rebase draft fix(ci): consume the published MinIO image #7870 onto current main, retarget it to main, run its integration checks, and merge it to switch all MinIO-backed CI jobs to the published image.

Validation

• Updated hosted MinIO image build and smoke test passed at 700ab6d5346b37a64c9defde0016dc65c98aa790; publication correctly skipped on the PR.
• Hosted ordinary CI passed at the same head. Its actual Git comparison detected only the five publisher files, all application path filters were false, and the MinIO-dependent integration checks were correctly skipped. Synced current main before this run to eliminate an earlier stale-base comparison that included unrelated ACP changes.
• Actual five changed paths were passed through the repo's pinned dorny/paths-filter: all application domains were false. All 12 existing path-selection cases and the required-context isolation contract also passed.
• Publisher actionlint, smoke-script shellcheck, and commit/push hooks passed.
• Fresh local rebuild of 700ab6d5346b37a64c9defde0016dc65c98aa790 passed with docker buildx build --no-cache --platform linux/amd64 --load. Logs confirm new Alpine index fetches and package installation rather than a cached install layer. The committed smoke script passed under local AMD64 emulation using the current merged Compose services with isolated resource names and no published ports: healthcheck, initializer/private bucket, object upload/read/delete, and anonymous HTTP 403. Temporary containers, network, and volume were removed. Both pinned binary checksums match the official release SHA-256 files.
• Full just ci was previously attempted: workspace formatting/Clippy, desktop checks, and Tauri formatting passed; the run was stopped during Tauri Clippy. No full local application-suite pass is claimed; hosted application suites correctly skip this publisher-only change.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is ea1e97e65f816a1f4d92f2da6e3498eb90f5d361...700ab6d5346b37a64c9defde0016dc65c98aa790.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 700ab6d5346b37a64c9defde0016dc65c98aa790 to authorize a new review.
Any previous review applies only to its recorded range.