ADR-037 CI publishes a public image of every commit on main

kubectl apply of the installer (ADR-009) can only bring QuantyKube to a node as a container image, so CI builds one on every push to main, once the tests and both kubeadm jobs have passed, and pushes it to ghcr.io/quantyroot/quantykube, tagged with the commit and main. It is public, so a cluster pulls it without credentials. The image is the release binary on distroless's cc-debian13: glibc and nothing else, no shell. The binary is built on the runner, whose glibc is older than the image's and the nodes', so install store can copy it onto the host from inside the container.

The cost: every commit on main is public as a runnable image, not only as source. The manifest names an image by commit, never main, so a cluster runs what was tested. The base image is named by tag, not digest; pinning it is a follow-up.