ci(docker): add v2 Dockerfile + GHCR publish job (#1646)

v1 published a container image but v2 arrived with no Dockerfile (the
client/server/cli layout is gone). Add a v2 image for the single-package /
launcher architecture and wire the release-gated GHCR publish job.

- `Dockerfile`: two-stage build — stage 1 installs + `npm pack`s the publishable
  tarball; stage 2 `npm install -g`s that tarball, so the image ships the exact
  same artifact as npm with a clean `mcp-inspector` bin. Defaults to `--web` on
  `0.0.0.0:6274`, browser auto-open off. `.dockerignore` keeps the context lean
  and forces a clean in-container install/build.
- `publish-github-container-registry` job in main.yml (ported from v1):
  release-gated, multi-arch (amd64/arm64) build+push to GHCR with a provenance
  attestation. Independent of the npm `publish` job.
- README: document the image + how to run it; the release section now covers
  both publish jobs.

Verified locally: `docker build` succeeds, the container serves `/` (HTTP 200
with the injected token) and dispatches `--cli` / `--tui`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BrihGWcrM9JGRyu41nzZYw

Dockerfile

@@ -0,0 +1,36 @@
+# syntax=docker/dockerfile:1
+
+# ---------------------------------------------------------------------------
+# Build stage — install everything, build all clients, and pack the exact
+# tarball npm would publish. `npm install` runs the root postinstall cascade
+# (per-client installs, since v2 is not a workspace); `npm pack` runs `prepack`
+# (`npm run build`) and emits `modelcontextprotocol-inspector-<version>.tgz`.
+# ---------------------------------------------------------------------------
+FROM node:22-slim AS builder
+WORKDIR /build
+COPY . .
+RUN npm install && npm pack
+
+# ---------------------------------------------------------------------------
+# Runtime stage — install just the packed tarball (production deps only),
+# yielding a clean global `mcp-inspector` bin: the same artifact a user gets
+# from `npm i -g @modelcontextprotocol/inspector`. The package's postinstall
+# early-exits under node_modules, and the tarball ships only each client's
+# build/ output, so there is nothing to build here.
+# ---------------------------------------------------------------------------
+FROM node:22-slim AS runner
+ENV NODE_ENV=production
+
+COPY --from=builder /build/modelcontextprotocol-inspector-*.tgz /tmp/inspector.tgz
+RUN npm install -g /tmp/inspector.tgz && rm /tmp/inspector.tgz
+
+# Serve on all interfaces so the UI is reachable from outside the container, and
+# never try to open a browser from inside it.
+ENV HOST=0.0.0.0 \
+    CLIENT_PORT=6274 \
+    MCP_AUTO_OPEN_ENABLED=false
+EXPOSE 6274
+
+# Default to the web UI; override the args to run --cli / --tui.
+ENTRYPOINT ["mcp-inspector"]
+CMD ["--web"]