- .goreleaser.yaml: cross-compile harness CLI for linux/darwin × amd64/arm64
- release.yml: run GoReleaser on v* tags, create GitHub Release with binaries
- images.yml: build and push sandbox + launcher images to ghcr.io on
  tags and push to main
- Update all image refs from quay.io/rcochran/openshell to
  ghcr.io/robbycochran/harness-openshell
- Update Makefile REGISTRY default to ghcr.io

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Add pull_request trigger to images workflow (build-only, no push)
- Skip docker login on PRs (no registry auth needed for build)
- Add GHA cache for Docker layers (cache-from/cache-to)
- Validates Dockerfiles build successfully before merge

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Add path filters: only build images when sandbox/, profiles/, or
  providers.toml change (skip on Go-only changes)
- Tags always trigger (no path filter on v* tags)
- Install openshell CLI in launcher job (was missing from build context)
- Add PR tag patterns so metadata-action generates tags on PRs
- Scope GHA caches per image to avoid cross-contamination

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The from field matches openshell --from flag and accepts both:
- Dockerfile path: from = "sandbox/" (builds locally via Docker/Podman)
- Image ref: from = "ghcr.io/robbycochran/harness-openshell:sandbox"

Default profile now uses from = "sandbox/" for local Dockerfile builds.
Remote deploys auto-detect Dockerfile paths and substitute the registry
image (SANDBOX_IMAGE env var or ghcr.io default).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Restore path filters: only build when sandbox/, profiles/, or
  providers.toml change (tags always build)
- Switch from GHA cache to registry cache (stored as *-cache tags)
- PRs pull cache from main layers, only rebuild changed layers
- Always login to registry (needed to read cache on PRs)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The deb install puts openshell at /usr/bin/openshell, not ~/.openshell/bin/.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The Dockerfile build (from = "sandbox/") fails on podman gateway because
openshell builds to Docker daemon but the gateway pulls from Podman image
store. Revert to image ref until openshell supports podman-native builds.

ghcr.io image will be available after this PR merges and images workflow
pushes to main. Will switch to ghcr.io ref in a follow-up.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>