unified-cd: create reusable image publish workflow and thin wrappers

[jmservera]

Summary

Create one generic reusable image-publish workflow and convert the existing API/synthesis publish workflows into thin manual wrappers.

Files to create/modify

• Create .github/workflows/reusable-publish-image.yml
• Modify .github/workflows/api-image-publish.yml
• Modify .github/workflows/synthesis-image-publish.yml

Implementation notes

• Reusable workflow should accept inputs such as image_name, dockerfile, image_repository, and tag.
• Keep the operator approval gate (SYNTHESIS_IMAGE_PUBLISH_APPROVED) and the registry var validation.
• Keep Trivy image scanning before push even though CI already scans images.
• Keep environment: prod on the publish job so OIDC vars are available when called from other workflows (issue Fix OIDC credential resolution in ACR image publish workflows #145).
• Emit image_ref and image_tag outputs for downstream promotion.
• The API and synthesis wrappers should remain independently dispatchable and simply pass their specific Dockerfile/repository values.

Acceptance criteria

• Existing API and synthesis manual publish entrypoints still work independently.
• Reusable publish logic supports both images through inputs instead of duplicated YAML.
• Both publish paths run Trivy before push and require environment: prod for OIDC vars.
• Reusable publish outputs expose the pushed image_ref and image_tag.

Dependencies

• None.

[github-actions]

🔄 Ralph — Auto-Triage

Assigned to: Bender
Reason: Matched backend/API role keywords
Source: role-keyword

Ralph auto-triaged this issue using routing rules.
To reassign, swap the squad:* label.

[github-actions]

🏗️ Squad Triage — Leela (Producer Lead)

Issue: #151 — unified-cd: create reusable image publish workflow and thin wrappers
Assigned to: Bender (Platform / Backend)
Reason: Issue relates to backend/API work

@copilot evaluation: No strong capability match — routed to squad member.

Team roster:

• Leela (Producer Lead) → label: squad:leela
• Bender (Platform / Backend) → label: squad:bender
• Farnsworth (Script & Audio Editor) → label: squad:farnsworth
• Hermes (Safety & Security) → label: squad:hermes
• Amy (Distribution UX) → label: squad:amy
• Fry (QA / Tester) → label: squad:fry
• Ralph (Work Monitor) → label: squad:ralph
• @copilot (Coding Agent) → label: squad:copilot

To reassign, remove the current squad:* label and add the correct one.