ci: add self-built image verification workflow

[BFanSYe]

Summary

• Add a Chinese self-built GHCR image runbook for upstream hotfix sync, digest-only deploys, verification, and rollback.
• Harden build-sub2api-image.yml with upstream/ref inputs, required_fixes ancestor checks, missing-upstream counts, source-repo OCI labels, and a build-manifest.yaml artifact.
• Add read-only image/deploy verification scripts for GHCR digest identity, source revision labels, required fixes, production container identity, public HTTPS, and homepage markers.
• Add Makefile help targets and .gitignore allow-list entries for the new docs/scripts.

Verification

• bash -n scripts/verify-sub2api-image.sh scripts/verify-sub2api-deploy.sh
• shellcheck scripts/verify-sub2api-image.sh scripts/verify-sub2api-deploy.sh
• PyYAML parse of .github/workflows/build-sub2api-image.yml
• git diff --check
• staged diff secret-shape scan
• scripts/verify-sub2api-image.sh against current GHCR production digest and required fixes
• scripts/verify-sub2api-deploy.sh against current production sub2api container and FusionGate homepage marker
• Claude Code independent blocker review: ship it / no blockers

[github-actions]

All contributors have signed the CLA. ✅
_{Posted by the CLA Assistant Lite bot.}

[BFanSYe]

I have read the CLA Document and I hereby sign the CLA