Publish the Docker image built by the release workflow

[jzonthemtn]

.github/workflows/docker.yml builds the image and tags it philterd/philter-mcp:latest, then smoke-tests it, but sets push: false and has no docker/login-action step or registry credentials. Nothing is published: the Docker Hub repository philterd/philter-mcp does not exist.

This makes Philter MCP one of six components the Philterd Appliance has to build from source on first run. Of those six it is the cheapest to fix, since the workflow already builds and tags exactly the right name.

Acceptance Criteria

• The workflow authenticates to Docker Hub using repository secrets
• push: true on pushes to main and on tags
• Pull requests still build and smoke-test without pushing
• A release publishes an immutable version tag, not only latest
• The smoke test still runs against the built image before any push
• philterd/philter-mcp is public on Docker Hub with a description
• The README documents pulling the published image

[jzonthemtn]

Tracked in philterd/philterd-appliance#2.