[SIMPL-30451] Add Gitea Actions workflow that builds and publishes both images

Adapted from template-code-location's docker-publish.yml. The repository ships two images, so the workflow builds the code location from the root Dockerfile and the payload from payload/Dockerfile, and tags both with the same short SHA - that shared tag is what keeps a code location and the payload it dispatches on the same version.

Each image gets its own gate before it is pushed. The code location image must load its Dagster definitions and carry payload/work.py for the subprocess transport. The payload image must contain dagster_pipes and must not contain dagster, which is readiness checklist L11; running that assertion against the code location image fails as expected, so the check discriminates rather than passing vacuously.

Changelog: added

documents/user-guide/distributed-execution-guide.md

@@ -514,7 +514,7 @@ Tracked under SIMPL-30451.
 | Runnable loosely coupled reference implementation | AC4 | Complete (subprocess verified, K8s not cluster-run) |
 | Both images build; payload image passes the isolation check (L11) | Tech details | Complete |
 | Locally runnable jobs launched from the Dagster UI, evidence recorded in section 5.6 | Tech details | Complete |
-| Payload image published to the container registry | Tech details | **Pending** — needs the CI build job |
+| Payload image published to the container registry | Tech details | **Pending** — build workflow exists, awaiting registry secrets and a first run |
 | End-to-end run of `loosely_coupled_k8s_job` on a cluster | Tech details | **Pending** |
 | Screenshots of UI surfaces | Tech details | **Pending** — needs a deployed platform instance, not a local dev server |
 | Platform architecture document update | Tech details | **Pending** |