Add CI and package the connector as a published image

[dejanzele]

Adds GitHub Actions CI and packages the connector as a publishable image, following the armada / armada-operator release pattern.

ci.yml runs on every pull request, push to main, and v* tag: ruff lint, the test suite across the supported Python floor and ceiling (3.10 and 3.13), and a build of the connector image (build only, no push, no credentials). An aggregate job gates it as one required check.

release.yml mirrors the org's release flow. It triggers on: workflow_run after CI completes successfully on a v* tag (push the tag, or create a GitHub Release, which creates the tag). It validates the ref is a semver tag on main, then publishes the multi-arch image (linux/amd64, linux/arm64) to gresearch/armada-flyte-connector, tagged with the release version and latest. It authenticates through the org's existing armada-dockerhub GitHub Environment (DOCKERHUB_USER / DOCKERHUB_PASS) and is gated to the canonical repo, and it rejects a tag that does not match pyproject.toml's version. Because it reuses the org's environment and credentials, no new secret setup is needed.

It also packages the connector: deploy/Dockerfile (the c0 gRPC service image), deploy/kubernetes/connector.yaml (a Deployment and Service), a ruff.toml, and a .dockerignore.

[pavlovic-ivan]

Added a commit pinning all GitHub Actions in the new ci.yml/release.yml to full-length commit SHAs (tag kept as # vX comment), so this PR lands compliant with the org's "require actions pinned to a SHA" policy — otherwise the workflows would fail the first time they run once the policy is enabled. Pinned: actions/checkout, actions/setup-python, docker/{setup-qemu,setup-buildx,login,build-push}-action. Only uses: lines changed; Dependabot will keep the SHAs updated.