ci: build and publish minimal OCI module image

[EvgeniyPatlan]

Summary

Adds a CI pipeline that publishes a minimal multi-arch (amd64 + arm64) OCI image containing only libvalkeyaudit.so, intended to be consumed as a Kubernetes ImageVolume (or copied out with an init container). The final image is FROM scratch — no shell, no runtime — with the module at a stable /libvalkeyaudit.so path plus LICENSE.

This lets the audit module be shipped and version-pinned independently of the Valkey runtime image, and mounted into a stock valkey/valkey container.

What's included

• docker/Dockerfile.module — fetches valkeymodule.h for a pinned VALKEY_VERSION, builds the module with a portable per-arch -march baseline (amd64 → x86-64-v2, arm64 → armv8-a), strips, and copies in LICENSE. Builds only the valkeyaudit target with tests disabled.
• .github/workflows/publish-image.yml — builds each arch natively (no QEMU) and pushes by digest, then merges into a single manifest list. Per-arch builds set provenance/sbom=false so the published index contains exactly two platform entries and no unknown/unknown attestation manifest (some kubelet/containerd ImageVolume paths choke on that). Supply-chain metadata is instead attached to the final index via GitHub build provenance attestation + keyless cosign signing. Triggers on v*.*.* tags and workflow_dispatch.
• CMakeLists.txt — two small, backwards-compatible changes that the Dockerfile relies on:
  • Route Release flags through a new AUDIT_C_FLAGS_RELEASE cache variable. The current set(CMAKE_C_FLAGS_RELEASE ...) is a plain (non-cache) set that silently shadows any -DCMAKE_C_FLAGS_RELEASE passed on the command line — so the distributable build's portable -march override was being discarded and -march=native used instead (would SIGILL on older CPUs). Local dev still defaults to -march=native.
  • Add a VALKEY_AUDIT_TESTS option (default ON) so the artifact build can skip the configure-time googletest FetchContent download.

Published image name / tags

Package is published as ghcr.io/<owner>/valkey-audit-module (lowercased — GHCR rejects uppercase repo paths). Example tags on a v1.0.0 release: 1.0.0, 1.0, 1, latest, valkey9.1.0 — all pointing at the same multi-arch index.

Test plan

Verified end-to-end on a fork:

• Local build replicating the Dockerfile steps — module compiles with -march=x86-64-v2, googletest skipped, ldd shows libc-only deps.
• actionlint clean (only intentional SC2086 word-split on imagetools create).
• Full workflow_dispatch run green: native amd64 + arm64 builds → merged manifest list with exactly linux/amd64 + linux/arm64 (no unknown/unknown) → cosign signature pushed + provenance attested.
• Confirmed default -march=native is preserved for normal local/CI builds.

Notes

• GHCR packages are private by default; the package must be made public for unauthenticated ImageVolume pulls.
• The third-party actions are pinned to versions currently emitting Node.js 20 deprecation warnings — a future version bump, not blocking.