Add official Docker image for the P toolchain

[crowecawcaw]

Closes #980.

Adds an official Docker image for the P toolchain so P can be compiled and checked without installing the .NET SDK, Java, Maven, and graphviz by hand — especially handy for CI and for trying P out.

What's included

• Dockerfile — multi-stage build.
  • Stage 1 builds the p CLI from this repository's source (dotnet pack), so the image always matches the committed/released code (no dependency on the NuGet package already being published).
  • Stage 2 is the toolchain image: .NET SDK 8.0, JDK 17, Maven, graphviz, and the p tool installed from the locally-built package.
  • JDK 17 is used deliberately: Src/PEx/pom.xml targets Java 17, so the PEx/PSym backends need a JVM that can run Java-17 bytecode.
  • JAVA_HOME is resolved via a stable symlink so it's correct on both amd64 and arm64 (the Debian JDK path is arch-specific).
• .dockerignore — keeps the build context small (excludes .git, build drops, docs, etc.).
• .github/workflows/docker-image.yml — PR CI. Path-filtered so it only runs when the Dockerfile, .dockerignore, or the workflow itself changes (plus manual dispatch) rather than on every push. Builds natively on amd64 (ubuntu-latest) and arm64 (ubuntu-24.04-arm), smoke-tests p compile + p check on a tutorial inside the container, and runs a Trivy vulnerability scan (report-only).
• .github/workflows/docker-publish.yml — on a published GitHub Release, builds per-arch natively, pushes each by digest, and assembles a multi-arch manifest to ghcr.io/p-org/p tagged with the release version + latest.
• .github/dependabot.yml — keeps the base image and the GitHub Actions used here up to date.
• Docs — a Docker section in the installation guide (referenced from the quick start), plus a README badge and run snippet.

Usage

docker run --rm -it -v "$PWD":/workspace ghcr.io/p-org/p:latest
# inside the container:
p compile
p check -tc <testcase> -i 1000

Testing done

Built and ran locally on arm64:

• docker build succeeds.
• Inside the container: p compile + p check -tc tcSingleClient -i 200 runs the Java PEx backend end-to-end (200 schedules explored, 0 bugs, coverage report written); JDK 17, Maven, graphviz, and JAVA_HOME all verified in both login and non-login shells.

CI in this PR exercises the build + smoke test on both amd64 and arm64.

Note on availability

The image is only published when a GitHub Release is created, and a repo's first GHCR package is created private. So before anyone can docker pull ghcr.io/p-org/p, a maintainer will need to:

1. Cut a release (or run the publish workflow manually) to push the first image, and
2. Flip the ghcr.io/p-org/p package to public (optionally linking it to the repo).

No code change needed for that — it's a one-time settings step around the first release.

Choices made (happy to change)

• Version tag source — the publish workflow derives the image version from the release's git tag (p-<version>), plus latest. Releases cut without that tag format would only get latest.
• Trivy is report-only (exit-code: 0) so new upstream CVEs don't block PRs. Can be made blocking (keeping ignore-unfixed: true) if preferred.
• Image scope — this is a toolchain/dev image (SDK-based, not slim). A smaller runtime image could be a separate tagged variant later.
• Kept the image and workflows close to the Dockerfile proposed in Request: official P docker image #980.