ci: build tools and validator images produced together with aptos-node

[apenzk]

⚠️ Blocked on GHCR package permissions. This workflow cannot push the rust / builder-base / tools / validator packages from CI — it fails with permission_denied: write_package (unlike aptos-node, whose package grants the repo write). Those packages need movementlabsxyz/aptos-core granted Write before CI here can go green.

Summary

The publish-builder-images workflow rebuilt the tools image only on select m1 changes and did not build the validator image at all — so neither rode along with the per-commit aptos-node image. This makes tools and validator build from the same commit as aptos-node, so every SHA carries a framework-consistent aptos-node / validator / tools set.

Why

• Same-commit requirement: the tools image (bakes in the Move framework used for genesis) and the validator / aptos-node image (the node VM) must come from the same commit — a genesis blob or migration built against one framework version only runs correctly on a matching node VM.
• Not produced together today: aptos-node is produced at each commit, but tools / validator are not built alongside it, so no single SHA has all three aligned.
• Concrete failure: 0x1::governed_gas_pool, which the post-move2 migration calls, is absent from the stale tools framework and fails with a LINKER_ERROR. Producing all three together keeps them consistent at any SHA.
• Unblocks: the ephemeral-devnet-via-forge work (DRAFT feat(forge): stand up a mainnet-aligned ephemeral devnet via the k8s backend #398), which hit exactly this mismatch.