Publish multi-architecture container image

[koko3tallah]

What changed

• add a minimal scratch-based container image that runs as a non-root user
• publish Linux AMD64 and ARM64 images to GHCR with provenance and an SBOM
• add CI for the Go binary and container security properties
• document a pinned container command beside the existing install options

Why

The CLI already ships through native package managers, but CI jobs and short-lived operator environments often need a portable command without installing anything on the host. This adds that path while keeping the runtime image to the binary and CA certificates only.

Validation

• go test -race ./...
• go vet ./...
• Linux AMD64 and ARM64 Go cross-builds
• actionlint v1.7.12
• local Linux ARM64 container build and execution
• version, non-root user, read-only filesystem, no-shell runtime, alert link, and live status checks
• git diff --check