feat(ci): add Docker build pipeline with version management

- Add multi-stage Dockerfile with pinned tool versions (Node 24.10.0, Go 1.25.1, Hugo 0.151.0)
- Create .env.versions as single source of truth for all tool versions
- Add GitHub Actions CI workflow for automated OCI image builds
  - Multi-arch support (amd64, arm64)
  - Automatic version loading from .env.versions
  - Docker registry push with metadata tags
- Add Taskfile tasks for local OCI image building and testing
  - task build:oci-image - Build with version-pinned dependencies
  - task test:oci-image - Build and test container locally
- Pin devbox.json to specific versions matching .env.versions
- Add comprehensive documentation (DOCKER.md, VERSIONS.md)
- Add helper script (scripts/get-versions.sh) for version extraction

This enables consistent development and production environments with
identical tool versions across local devbox, Docker builds, and CI/CD.

VERSIONS.md

@@ -0,0 +1,69 @@
+# Version Management
+
+## Single Source of Truth: `.env.versions`
+
+All tool versions are centrally managed in `.env.versions`:
+
+```bash
+NODE_VERSION=24.10.0
+GO_VERSION=1.25.1
+HUGO_VERSION=0.151.0
+```
+
+## Where are versions used?
+
+1. **devbox.json** - Local development environment (manual sync required)
+2. **Dockerfile** - Build arguments with defaults
+3. **.github/workflows/ci.yaml** - CI/CD pipeline (automatic)
+4. **scripts/get-versions.sh** - Helper script for local builds
+
+## Updating Versions
+
+### Step 1: Update `.env.versions`
+
+Edit the file with new versions:
+
+```bash
+NODE_VERSION=24.12.0
+GO_VERSION=1.25.2
+HUGO_VERSION=0.152.0
+```
+
+### Step 2: Update `devbox.json`
+
+Manually sync the versions in `devbox.json`:
+
+```json
+{
+  "packages": [
+    "hugo@0.152.0",
+    "go@1.25.2",
+    "nodejs@24.12.0",
+    ...
+  ]
+}
+```
+
+### Step 3: Rebuild devbox environment
+
+```bash
+devbox shell --refresh
+```
+
+### Step 4: Test Docker build
+
+```bash
+source scripts/get-versions.sh
+# Follow the printed docker build command
+```
+
+## Why not automatic devbox sync?
+
+- devbox.json uses a different version format (e.g., `@latest` vs specific versions)
+- devbox package names may differ from Docker image names
+- Keeps devbox.json simple and readable
+- Manual sync ensures intentional version updates
+
+## CI/CD
+
+The GitHub Actions workflow automatically loads versions from `.env.versions` - no manual intervention needed.