Add Test-Published task for testing images from a registry

firebird-docker.build.ps1:
- New task Test-Published: runs the full test suite against final published
  images (ghcr.io/<owner>/firebird:tag) — same images end users pull.
  Pulls each image before testing. Requires -Registry.
  Unlike Test (which targets local arch-specific staging images), this
  exercises the actual multi-arch manifest from the registry.

CONTRIBUTING.md:
- Document Test-Published with usage examples
- Document snapshot testing via FULL_IMAGE_NAME override

Author: fdcastel

CONTRIBUTING.md

@@ -74,6 +74,30 @@ Invoke-Build Test -TestFilter "FIREBIRD_USER_can_create_user"
 Invoke-Build Test -VersionFilter "5" -DistributionFilter "noble"
 ```
 
+### Testing published registry images
+
+Use `Test-Published` to run the full test suite against images already pushed to a registry (the same final images end users pull). Requires `-Registry`.
+
+```bash
+# Test all images published to a fork's ghcr.io registry
+Invoke-Build Test-Published -Registry "ghcr.io/myusername"
+
+# Narrow down to a specific version + distro
+Invoke-Build Test-Published -Registry "ghcr.io/myusername" -VersionFilter "5.0.3" -DistributionFilter "bookworm"
+
+# Test the official Docker Hub images
+Invoke-Build Test-Published -Registry "firebirdsql"
+```
+
+Unlike `Test` (which tests locally built arch-specific staging images), `Test-Published` pulls and tests the final multi-arch manifest — exactly what a user would run.
+
+For snapshot images (not in `assets.json`), set `FULL_IMAGE_NAME` directly:
+
+```bash
+$env:FULL_IMAGE_NAME = "ghcr.io/myusername/firebird:6-snapshot"
+Invoke-Build * ./src/image.tests.ps1
+```
+
 ### Tag unit tests
 
 ```bash

firebird-docker.build.ps1

@@ -354,6 +354,51 @@ task Test FilteredAssets, {
     }
 }
 
+# Synopsis: Test published images pulled directly from a registry (requires -Registry).
+# Unlike Test (which uses locally built arch-specific images), this task tests the final
+# published images — the same ones end users pull.
+#
+# Examples:
+#   Invoke-Build Test-Published -Registry 'ghcr.io/myusername'
+#   Invoke-Build Test-Published -Registry 'ghcr.io/myusername' -VersionFilter '5.0.3' -DistributionFilter 'bookworm'
+#   Invoke-Build Test-Published -Registry 'firebirdsql'
+task Test-Published FilteredAssets, {
+    $imagePrefix = $script:imagePrefix
+    $imageName = 'firebird'
+    $testFile = './src/image.tests.ps1'
+
+    if (-not $imagePrefix) {
+        Write-Error "Use -Registry to specify which registry to test. Example: Invoke-Build Test-Published -Registry 'ghcr.io/myusername'"
+        exit 1
+    }
+
+    if ($TestFilter) {
+        Write-Verbose "Running single test '$TestFilter'..."
+    } else {
+        Write-Verbose "Running all tests..."
+        $TestFilter = '*'
+    }
+
+    $assets | ForEach-Object {
+        $asset = $_
+
+        $asset.tags | Get-Member -MemberType NoteProperty | ForEach-Object {
+            $distribution = $_.Name
+            # Use the most-specific tag (first in list, e.g. '5.0.3-bookworm') to avoid
+            # accidentally re-testing the same image under an alias tag.
+            $tag = $asset.tags.$distribution | Select-Object -First 1
+
+            Write-Build Magenta "----- [$($asset.version) / $distribution] -----"
+
+            $env:FULL_IMAGE_NAME = "$imagePrefix/${imageName}:$tag"
+            Write-Build Cyan "  Pulling $($env:FULL_IMAGE_NAME)..."
+            docker pull $env:FULL_IMAGE_NAME *>&1 | Select-String 'Status:|Error' | Write-Build DarkGray
+            Invoke-Build $TestFilter $testFile
+        }
+    }
+}
+
+
 # Synopsis: Retag and push images using the final name (no -arch suffix). Use for single-arch publishing.
 # Produces only one package (e.g. ghcr.io/owner/firebird) with no staging intermediates.
 task Publish-Direct FilteredAssets, {