Publish as a distroless container and add a major-version release tag

[Mpdreamz]

assembly-differ publishes to ghcr.io/nullean/assembly-differ as a distroless container image with a matching GitHub Action, and each release now also gets a floating major-version git tag.

Prompt summary: Add the same ghcr.io container publishing curb already has, wrap it in a GitHub Action that calls the container, and add a floating major-tag workflow so this repo can be pinned as a GitHub Action the way actions/checkout@v5 is — to this repo and to curb, if curb doesn't have it yet.

Why

Every consumer of assembly-differ needed the .NET SDK installed to run it, even in CI, where a workflow step just wants to diff two assembly sources and read the result. curb solved this for itself in nullean/curb#72; this repo didn't have the equivalent yet. There was also no way to reference this repo as a GitHub Action pinned to a major version — only exact tags — so a consumer wanting automatic minor/patch updates within a major had nothing to pin to.

What

Container image

assembly-differ.csproj gains EnableSdkContainerSupport, and a new publishContainers target in Targets.fs runs dotnet publish -t:PublishContainer against the linux-x64 AOT build on top of mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled — no shell, minimal surface, correct for a binary with no managed runtime to host. Tags follow the same split curb uses: edge on every push to master, plus latest and the plain semver when the push is an exact release tag.

CI

The aot-pack matrix's linux-x64 leg now also builds the container image without pushing, purely to prove the build itself still works on every trigger. The build job logs in to ghcr.io and pushes for real, but only on push events, and only after the managed packages ship to GitHub Packages.

GitHub Action

A new action.yml at the repo root wraps docker://ghcr.io/nullean/assembly-differ:edge, taking first and second (the two provider specs diff already takes) plus a passthrough args for everything else — so a workflow can diff two assemblies with a single uses: line and no SDK setup.

Major-version tag

A new create-major-tag.yml workflow runs on every published release and force-pushes a vN tag at that commit, so a workflow can pin uses: nullean/assembly-differ@v1 and follow every 1.x.y release automatically, the same way actions/checkout@v5 works.

Out of scope

curb doesn't have the major-tag workflow either — that's added directly to curb in a separate change, not through this PR.

Verify

docker run --rm ghcr.io/nullean/assembly-differ:edge diff --help

CI's aot-pack (linux-x64) leg proves the container still builds on every PR; the full push to ghcr.io only happens on a push to master or a release tag.