#1490 Add a workflow that builds and pushes the Docker image on a version tag

Description

Issue: Resolves #1482

## Summary
Builds the CUDA Docker image in GitHub Actions on a `v*` tag and pushes it to GHCR, so users can `docker pull` instead of compiling the engine themselves (docs/INSTALL.md, "Docker (Linux)"). Closes the gap described in #1482.

## What changed
- `.github/workflows/release-docker-image.yml` (new): builds and pushes on a `v*` tag, plus `workflow_dispatch` for a manual rebuild (which does not move `:latest`). The version comes from the tag and must match `project(strata VERSION ...)` in CMakeLists.txt. amd64 only: the engine needs x86-64 AVX2, and an emulated arm64 CUDA compile could not run on an arm64 GPU host anyway. Tags: `:latest`, `:<version>`, `:<version>-cuda13` — the `-cuda13` suffix leaves room for a HIP or SYCL image later. No secrets: the built-in `GITHUB_TOKEN` with `packages: write` pushes to GHCR.
- `Dockerfile`: new `ARG PORTABLE=0`, threaded into the engine and vision cmake calls. A published image is not built on the PC it runs on, so CI sets `PORTABLE=1` to get the AVX2 floor (CMakeLists.txt's `STRATA_PORTABLE`, the same failure #411 #412 #419 fixed for the vision encoder). The default stays native, so `docker build -t strata .` is unchanged.

## Extra Notes
Measured on my fork (nullata/Strata, [run 37717607320](https://github.com/nullata/Strata/actions/runs/37717607320)): one uncached build on ubuntu-latest takes ~1h32m; the image is 5.3 GB compressed. Runner disk is not a problem (86 GB free). The image has not been run on a GPU yet — CI has none. If you'd rather keep Docker builds native-only, closing this PR (and #1482) is fine.