ci: add deploy dry-run workflow

[plutoless]

Summary

• Add a deploy dry-run GitHub Actions workflow for PRs and non-main pushes.
• Build and boot the production Docker image locally, then verify /api/health and the served UI.
• Keep the dry-run isolated from GHCR pushes, SSH, VPS deploys, and production secrets.

Verification

• .venv/bin/python static workflow check: workflow-check-ok
• Ruby YAML parse: yaml-ok
• .venv/bin/python -m pytest: 671 passed, 1 warning
• Docker smoke test under Colima: image built, container served {"status":"ok"} at /api/health and HTML at /, then cleanup removed the container