ci: publish the FFI as an image from this repo

[pigri]

The FFI shared library is currently built downstream: a consumer clones this repo inside its own Docker build, at a commit named in an ARG it bumps by hand, and tags the result with its commit sha.

Two consequences, both of which have already happened:

• The image identity says nothing about which engine is inside it.
• The ARG drifted three releases behind — shipping a library with neither ends_with (0.7.2) nor the JSON lookup functions (0.7.4) — and nothing failed, because that ARG was the only thing asserting what the image contained.

Building it here removes the class: the image is produced by the source it ships, tagged with the version that source declares, by the same workflow that already verifies the tag matches Cargo.toml.

Shape

• Multi-arch on native runners. This is a Rust release build; under QEMU it does not finish inside a sane timeout.
• Push by digest, then merge. One tag cannot name two single-arch manifests without the second replacing the first.
• Index digest printed to the step summary, so consumers can pin the digest rather than the tag.
• workflow_dispatch takes an image-version input, because 0.7.4 shipped before this job existed and its image must be publishable without inventing a crate release to carry it.
• Layout unchanged at /tmp/libwirefilter_ffi.so, so existing COPY --from=wirefilter consumers keep working.

Verification

Built the image locally and linked rules-validator against the library it contains. All five functions 0.7.4 exports validate against the real engine:

lookup_json_string     VALID
lookup_json_integer    VALID
to_string              VALID
upper                  VALID
remove_query_args      VALID
ends_with              VALID   (0.7.2)
ids.sids               VALID   (smart_firewall scheme)

shellcheck over the new run: blocks is clean and the workflow parses with the expected job graph.

The push path itself cannot be exercised by a PR — it needs a tag or a dispatch. First real test is publishing 0.7.4's image via workflow_dispatch.

Base branch

Targets release/v0.7.3, because v0.7.4 exists only there and a workflow runs as it exists at the tagged commit. That leaves master without this job — reconciling the two is a follow-up, not something to smuggle into this PR.

[pigri]

Closing: the image release belongs with the consuming repo's tag train, not in the engine repo.