feat: migrate test-tools to pre-built GHCR image (closes #106)

[ycpss91255]

Summary

v0.9.12 tried to fix test-tools:local CI resolution with load: true, but that turned out not to share images between buildx steps (docker/build-push-action#581). First caught when ros1_bridge PR #25 became the first downstream repo to actually consume test-tools:local — CI died at pull access denied, repository does not exist trying to fall back to Docker Hub.

This PR ships the D plan: publish test-tools to GHCR per tag, and parameterize the downstream Dockerfile with ARG TEST_TOOLS_IMAGE so buildx pulls the arch-correct pre-built image directly.

Changes

New workflow: release-test-tools.yaml

Triggers on push: tags: ['v*'] + workflow_dispatch. Multi-arch (amd64 + arm64) build of Dockerfile.test-tools, pushed to ghcr.io/ycpss91255-docker/test-tools:<tag> + :latest. Uses GITHUB_TOKEN with packages: write.

build-worker.yaml

• Removes the in-job Build test-tools image step (eliminates cross-step buildx image-store race).
• Adds a version-resolution step that parses GITHUB_WORKFLOW_REF to derive the template tag the downstream pinned (e.g. v0.9.13), then passes TEST_TOOLS_IMAGE=ghcr.io/ycpss91255-docker/test-tools:v0.9.13 as a build-arg.

Dockerfile.example

• Top-level ARG TEST_TOOLS_IMAGE="test-tools:local" default keeps local ./build.sh flow unchanged.
• New FROM ${TEST_TOOLS_IMAGE} AS test-tools-stage alias before the test stage.
• All four COPY --from=test-tools:local call sites switched to --from=test-tools-stage.

Tests (+9 / -1)

• Dropped the v0.9.12 load: true assertion (no longer applies; the step is gone).
• Added regression guards: no leftover test-tools build step, GITHUB_WORKFLOW_REF parsing present, TEST_TOOLS_IMAGE build-arg wired, Dockerfile.example ARG + named stage + 4 --from=test-tools-stage + 0 legacy --from=test-tools:local, release-test-tools.yaml publishes to correct GHCR path with packages:write + multi-arch.

Docs

• CHANGELOG [Unreleased] flags BREAKING for downstream repos pinning @v0.9.13+ (they must adopt the ARG + named stage pattern).
• README (en / zh-TW / zh-CN / ja) Dockerfile.test-tools paragraph rewritten to document the dual local/CI paths.
• TEST.md 655 → 663 (template_spec 106 → 114).

Bootstrap sequence (post-merge)

1. Merge this PR to main.
2. Manually run release-test-tools.yaml via workflow_dispatch → publishes ghcr.io/ycpss91255-docker/test-tools:latest. Set GHCR package visibility to public so anonymous pulls work.
3. Open release PR for v0.9.13 (bumps .version + CHANGELOG cut).
4. Merge release PR, tag v0.9.13 → release-test-tools.yaml auto-publishes :v0.9.13.
5. Update downstream ros1_bridge PR fix: switch to codecov-action@v5 tokenless upload #25: Dockerfile ARG TEST_TOOLS_IMAGE + named stage pattern, main.yaml bumps @v0.9.12 → @v0.9.13, CI validates the end-to-end flow for the first time.

Test plan

• make -f Makefile.ci test local — 663/663 pass
• CI template self-test green on this PR
• Post-merge + tag + ros1_bridge downstream: CI resolves TEST_TOOLS_IMAGE to GHCR tag and builds successfully

Closes #106.