ci: build cloud images independently for each merge (#13189)

Build cloud images independently for each master commit through a reusable workflow. Preserve production release dependencies and image runtime checks, and write cloud registry caches per commit with bounded ancestor imports to prevent overlapping builds from replacing each other's cache.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/scripts/tests/lockfile-refresh-workflows.test.mjs

@@ -6,6 +6,7 @@ const workflows = [
   '.github/workflows/refresh-lockfile.yml',
   '.github/workflows/pr-trusted.yml',
   '.github/workflows/docker.yml',
+  '.github/workflows/docker-cloud.yml',
 ];
 
 test('lockfile repair workflows resolve dependencies instead of updating metadata only', async () => {