Document named dev containers; limit image republish to image files

[ashishjullia]

• Readme: `dev()` now names each container `dev--` (or `dev-`) and sets the hostname to match; documents finding it with `docker ps --filter name=dev-` and using `docker exec -it /script.sh`.
• Workflow: pushes to `main` republish `:latest` only when `Dockerfile`, `script.sh`, `mfa.sh`, `aws-role-credentials`, `aws-mfa-session` or the workflow itself change. Pull requests are unfiltered so the required `build` check still reports. `prod-*` tags are unaffected.

🤖 Generated with Claude Code