Add Codex and T3 images with independent releases - #2

Summary

Add separate Amazon Linux images with independent product versions and update checks:

ghcr.io/zeroae/
├── claude-code  Claude CLI, VSIX, Windows CLI
├── codex        Codex CLI, Linux/Windows VSIX, full Windows CLI bundle
└── t3-code      T3 server/web/desktop, Claude and Codex, Windows payloads

Publish unique snapshots first, verify installed versions and artifacts, then promote eligible version/alias tags. Historical releases cannot roll aliases backward; scheduled checks repair stale aliases even when a prior success marker exists. Add persistent Compose services and document authentication and extraction.

Evidence

• Before: Only the Claude image existed, with Claude-only release detection.
  After: Three image targets build locally on ARM64; CLI, VSIX, Windows artifact, and T3 web checks pass. The native desktop app opens its welcome screen and starts its backend under a virtual display.
• 18 release regression tests pass, including independent tagging, dependency updates, historical-release protection, and alias drift repair.
• Actionlint, shell syntax, and whitespace checks pass. AMD64 validation runs in CI.

Merge Danger

Door: two-way

Code can be reverted. Publishing creates two additional GHCR packages and moves image aliases only after verification.

Blast Radius: releases

Changes the shared image build and automated publication workflows. Provider authentication remains a runtime concern; Windows binaries are validated as artifacts, not executed on Linux.