Block merges that break the Docker Compose image build #108

A pull request can merge into dev while the images that docker compose up -d builds are broken. The install guide clones dev, so a new user gets the broken build.

Order: do this first. #107 publishes the images this check builds, and #106 points the guide at a tag that passed it.

What happened

• chore(stack): point submodules at Boot 4.1.1 and Angular 22.2.3 #97 moved the viewer to Angular 22 and merged into dev at 2026-10-20 09:35 UTC with all seven checks green: e2e-admin, e2e-viewer, e2e-application-contact, e2e-mia-cross, e2e-mobile-web, e2e-mobile-android, changelog-immutability.
• The front image no longer built. front/Dockerfile renders front/viewer/webpack.config.js.template over the viewer webpack.config.js, and the template lacked the Angular 22 aliases (among them the empty @spz-loader/core module). Compose started no containers.
• fix(docker): build the viewer with the Angular 22 webpack config #99 (86678cd4) fixed the template at 13:20 UTC. The failure an outside user hit that morning was this image build, not a missing .env.

Why CI missed it

• .github/workflows/ has no docker compose build or docker build step. E2E builds the apps with npm and Gradle on the runner, so Dockerfile and template drift is not tested.
• Neither dev nor main has branch protection (GET /repos/sitmun/sitmun-application-stack/branches/{dev,main}/protection returns Branch not protected). A red check could not block a merge today.

Tasks

• Add a workflow that runs docker compose build front backend proxy (default postgres profile) and COMPOSE_PROFILES=postgres,mbtiles docker compose build mbtiles, with recursive submodule checkout.
• Build with the same Dockerfiles, templates, and build args as the install guide (PUBLIC_BASE_PATH=/, ENVIRONMENT=development).
• Trigger it on pull_request and on push to dev and main.
• Turn on branch protection for dev and main with this check required (repository admin).

Acceptance

• Reverting fix(docker): build the viewer with the Angular 22 webpack config #99 on a branch makes the check fail on its pull request, and the pull request cannot be merged.
• On current dev, the check passes.

Related: #106, #107.