Fix container startup: ensure musl-linked AOT binary and add runtime libs

[damianh]

Summary

The container image fails to start with Error loading shared library ld-linux-x86-64.so.2 because CI and release were building the container via dotnet publish /t:PublishContainer on Ubuntu with just musl-tools installed. This produced a glibc-linked AOT binary despite passing -r linux-musl-x64, which then fails on the Alpine (musl) runtime image.

This PR switches both CI and release workflows to build via the Dockerfile, which runs the AOT compilation on Alpine with the full musl toolchain (clang, musl-dev, build-base). It also adds a container smoke test that hits /_microstack/health after startup — so broken containers will fail the pipeline before being published.

Reviewer focus

• Dockerfile: removed --no-restore from publish, added libstdc++/libgcc to runtime image
• CI workflow: replaced dotnet publish /t:PublishContainer with docker build + smoke test
• Release workflow: same switch, plus docker push replaces SDK container publishing

Risk / impact

• Container images will now be built via Dockerfile instead of SDK container publishing
• Slightly different layer structure but functionally equivalent
• Smoke test adds ~5s to CI/release but catches startup failures