ci: add Docker image build workflow for sushi30 branch

Builds docker/Dockerfile on every push to sushi30 and pushes to
ghcr.io/sushi30/picoclaw with tags :sushi30 (rolling) and
:sha-<short-sha> (traceability). Uses GHA layer cache and linux/amd64.

Closes #23

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/sushi30-docker.yml

@@ -0,0 +1,49 @@
+name: 🐳 Build & Push Docker Image (sushi30)
+
+on:
+  push:
+    branches: ["sushi30"]
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: sushi30/picoclaw
+
+jobs:
+  build:
+    name: 🏗️ Build & Push
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: 📥 Checkout repository
+        uses: actions/checkout@v6
+
+      - name: 🔧 Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: 🔑 Login to GitHub Container Registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: 🏷️ Compute short SHA
+        id: sha
+        shell: bash
+        run: echo "short=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+
+      - name: 🚀 Build and push Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/Dockerfile
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sushi30
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:sha-${{ steps.sha.outputs.short }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/amd64