ci: publish the docsgpt-sandbox image

deployment/k8s/deployments/sandbox-deploy.yaml pulls arc53/docsgpt-sandbox,
which has never been pushed anywhere: Compose builds the runner from the
checkout (`build: ./sandbox`), but Kubernetes cannot build, so enabling code
execution on a cluster failed on an image that does not exist.

Build and push it like the other two images: `develop` on a push to main that
touches deployment/sandbox, and `<version>` plus `latest` when the release
workflow calls it. Release and develop live in one file here rather than two,
because the runner changes rarely and the only difference is which tags move.
The tag comes from the inputs and the release payload, not from
`github.event_name`, which is `push` when backend-release calls this.

.github/workflows/backend-release.yml

@@ -1,8 +1,8 @@
 name: Backend release
 
 # A version bump on main tags the commit, creates the GitHub release, then
-# publishes the backend and frontend Docker images and the PyPI package by
-# calling those workflows.
+# publishes the backend, frontend and sandbox Docker images and the PyPI
+# package by calling those workflows.
 # The release is created with GITHUB_TOKEN, and GitHub never starts workflows
 # from events that token produces, so the `release: published` triggers on the
 # publish workflows would not fire (0.18.0 got no images that way). Releases
@@ -123,6 +123,19 @@ jobs:
       contents: read
       packages: write
 
+  sandbox:
+    needs: release
+    if: needs.release.outputs.created == 'true'
+    uses: $/.github/workflows/sandbox-image.yml
+    with:
+      version: ${{ needs.release.outputs.version }}
+    secrets:
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+    permissions:
+      contents: read
+      packages: write
+
   pypi:
     needs: release
     if: needs.release.outputs.created == 'true'