stevedore migration readiness — blockers before docker-release runs on stevedore

[blairham]

Umbrella for migrating docker-release.yml onto stevedore. Callers are pinned to @pre-stevedore (#37) so main can evolve freely; pins come off per repo as it migrates, and the tag is deleted at the end.

Blockers

• Multi-runner fan-out (the big one) — feat: matrix mode — plan/fan-out so builds run across multiple GitHub runners blairham/stevedore#5: stevedore plan --json → GitHub matrix → stevedore release --only <id> per runner. Restores per-image runner parallelism for wide changes (13 trading images on one 4-vCPU runner would regress wall-clock), and — via a per-entry role field — restores the per-service xp-<name>-gha-push IAM mapping, so no repo-wide push role is needed.
• Release summary for Dispatch — feat: machine-readable release summary of pushed images blairham/stevedore#6: machine-readable pushed-images JSON so the workflow can call actions/notify-dispatch per image (warn-only, EventBridge ECR backstop unchanged).
• Cross-run build cache — the 12 .stevedore.yaml configs set no cache_from/cache_to, so every CI run builds cold; today's docker-release uses type=gha,scope=<name>. Add per-image cache to the configs + expose the Actions cache runtime env to stevedore's buildx invocations (e.g. crazy-max/ghaction-github-runtime). Note: ECR registry cache (:buildcache) is blocked by our immutable-tag ECR repos unless we add mutable cache repos — type=gha is the parity choice.
• stevedore-release.yml hardening — with matrix mode, restore the three-shot configure-aws-credentials retry (Crossplane role-creation race, trading#616) in the per-image job, and flip no-push default once the above land.

Non-blockers already done

• Marker refs: change_detection.marker_refs: true in all 12 configs, same refs/releases/image/<name> family; ids verified == service names.
• Build-once-tag-many: automatic in v0.0.3 (dis 5→1 build).
• ECR tag pruning hygiene under high-frequency builds: platform-gitops#1207.

🤖 Generated with Claude Code

[blairham]

Trading-specific cutover plan + build-once Dockerfile findings captured in #39 (single-job vs matrix-mode shape analysis, gha cache consolidation, per-repo context audit).