ci: publish and certify E2B templates on main

[hadarishav]

Every merge to main now builds and certifies an E2B hosted runtime using the existing scripts/e2b-template.py publisher. The workflow pushes a uniquely tagged Linux amd64 image to GHCR, imports its immutable digest into a commit-specific E2B template, runs the catalog certification checks, and saves the certified template reference and release metadata in the job summary and a downloadable artifact.

Relevant pull requests run credential-free publisher validation. Manual publishing is supported on main. Separate concurrency groups preserve publications for distinct commits, while reruns of a commit are serialized. Platform deployment configuration is not changed automatically.

Setup: add the repository Actions secret E2B_API_KEY. GHCR uses the job's built-in GITHUB_TOKEN with packages: write; no Docker Hub credentials are required. The E2B secret was absent when checked. DEVELOPMENT.md documents setup, outputs, failure behavior, and deployment handoff.

Validation:

• actionlint 1.7.12 passed for the new workflow (ShellCheck integration disabled; actionlint validates workflow syntax and expressions).
• python3 scripts/e2b-template.py --dry-run passed from the clean committed checkout.
• git diff --cached --check passed before commit.
• Live Docker publication and E2B certification were not run because the repository E2B credential has not been configured.