CI: build per-PR Docker test image on demand via label

[wezell]

Problem

There is no lightweight way to get a runnable Docker image for an open PR. Developers who want to test a branch's image today must trigger the manual deploy workflow (cicd_8-manual-deploy.yml), which pushes to dotcms/dotcms and is a manual, out-of-band step.

Proposal

Add a workflow that builds and pushes a test image automatically for any PR labeled PR: docker image:

• Triggers when the label is applied, or when a new commit is pushed to an already-labeled PR.
• Pushes to dotcms/dotcms-test (kept separate from the official dotcms/dotcms repo).
• Tags with the PR number + a normalized branch name, e.g. branch feat/bedrock-agentic-harness on PR fixes #1233 - showing 'current user(everyone)' when adding annon whocanu... #1234 → dotcms/dotcms-test:pr-1234-feat-bedrock-agentic-harness (plus an immutable ..._<sha> tag).
• Reuses the existing modern build phase (cicd_comp_build-phase.yml) and the deploy-docker composite action.

Notes

• Fork PRs cannot push (no access to DOCKER_* secrets) — internal branches only, by design.
• amd64-only to keep build time reasonable; multi-arch can be added later if needed.

[github-actions]

PRs linked to this issue

• feat(ci): build per-PR Docker test image on "PR: docker image" label by @wezell