ci: tolerate registry cache export failures

[JOY (JOY)]

Summary

• keep production image build and push failures fatal
• make only the optional GHCR registry cache export best effort with ignore-error=true
• run Dependency build when the publish workflow changes
• add regression tests for the workflow contract and trigger path

Root cause

Publish run 30925254027 attempt 1 pushed the production manifest successfully, then failed while exporting ghcr.io/dos/doscan:buildcache because GHCR denied the cache OAuth token. Docker documents ignore-error as the registry cache exporter option that ignores failed cache exports without changing the image exporter.

Verification

• TDD RED: 2 expected assertion failures before the workflow change
• focused tests: 2 passed
• full workflow script suite: 42 passed
• actionlint: passed for both changed workflows
• git diff --check: passed
• task review: 0 Critical, 0 Important, 0 Minor
• whole-branch review: 0 Critical, 0 Important, 0 Minor

Docker reference: https://docs.docker.com/build/cache/backends/registry/

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.