fix(jpeg): unbreak the arm64 build; add a publish-nothing Docker dry run

[swackhamer]

The bug

perl_sprintf_g declared its snprintf buffer as [0_i8; 32]. c_char is
signed on x86_64 but unsigned on aarch64-linux, so this never compiled for
aarch64-unknown-linux-musl:

error[E0308]: mismatched types
  --> src/core/jpeg_helpers.rs:1725:33
   | expected `*mut u8`, found `*mut i8`

Every arm64 Docker image build failed on it, and release.yml builds the
same target. It survived because arm64 is built only by those two workflows,
both of which run solely on a version tag — so it would first surface during a
release.

It also can't be caught on an arm64 Mac: signedness follows the platform ABI,
not the CPU. aarch64-apple-darwin is signed (verified locally),
aarch64-unknown-linux-musl is unsigned. Same chip, opposite sign.

Fixed by using libc::c_char instead of hardcoding either side.

The dry run that found it

docker.yml triggered only on v* tags, so the layer cache and the image build
were exercised only by a real release — a bad place to discover a broken
build or a misconfigured cache backend. The WarpBuild proxy settings this repo
now uses had never executed at all.

workflow_dispatch now builds both architectures exactly as a release does and
publishes nothing: push=false, and the Docker Hub login, smoke test, digest
export/upload and the entire manifest-list job are skipped. The ancestry gate is
short-circuited for dispatch deliberately — it exists to keep unreviewed commits
off Docker Hub, and a run that cannot push has nothing to gate.

Measured

The WarpBuild layer cache works (importing cache manifest from gha:…):

	cold	unchanged commit
Build amd64	232s	23s
Build arm64	309s	19s

Where the build time actually goes, measured, since it rules out the obvious
"cache dependencies in their own layer" tweak:

	amd64	arm64
RUN cargo build	163s	235s
├ third-party deps	~12s	~10s
├ oxidex-tags-*	~23s	~29s
└ oxidex itself	~128s	~195s

A dependency-layer split would save ~12s — the build is dominated by compiling
oxidex under [profile.release]'s lto = true + codegen-units = 1. That is
the shipped binary, so it is not changed here. .dockerignore already excludes
docs/, tests/ and .github/ so doc-only commits don't bust the layer.

🤖 Generated with Claude Code