build: containerize the control layer and publish it to GHCR

Add a second image for the handler control CLI (spawn/list/kill, approve/
reject, forge-init, CI poller) alongside the existing API image. It shares
the package, database, and /var/lib/handler volume but runs the control
process instead of uvicorn.

- Dockerfile.control: git + tmux baked in for live spawning; default CMD is
  the `poll-ci --watch` loop; RUN_MIGRATIONS toggle reuses docker-entrypoint.sh.
- docker-control.yml: builds/pushes ghcr.io/<repo>/control (multi-arch),
  scoped gha cache so it doesn't clobber the API build.
- docker-compose.yml: new `control` service, RUN_MIGRATIONS=false, depends on
  the API (which owns migrations) being healthy.
- README: Containers section documenting both images and compose usage.

.dockerignore

@@ -15,6 +15,7 @@ docs
 !.env.example
 *.db
 Dockerfile
+Dockerfile.control
 docker-compose.yml
 .dockerignore
 .mise.toml