feat: add Quartermaster OCI image

[cebarks]

Summary

Closes #313

• Adds container/quma/Containerfile — two-stage build that downloads the pre-built binary from a GitHub release, verifies the SHA-256 checksum, and packages it into a minimal fedora-minimal runtime image
• Adds .github/workflows/quma-image.yml — builds and pushes ghcr.io/cebarks/quartermaster/quma on release events and manual dispatch

Usage

podman run -d \
  -v /path/to/spt-server:/opt/spt \
  -p 9190:9190 \
  ghcr.io/cebarks/quartermaster/quma:latest

The bind-mounted SPT directory must be writable (database, config, logs, backups are written there).

Limitations

• Container management disabled — starting/stopping the SPT server or headless clients from inside the container requires Podman socket passthrough, out of scope for v1
• x86_64 only — matches the existing release target

Test plan

• podman build --build-arg QUMA_VERSION=v0.3.1 succeeds, checksum verified
• podman run --entrypoint quma quma:verify --version → quma 0.3.1
• podman run quma:verify without SPT dir → clean error message
• Build without QUMA_VERSION → clear error guard
• Build with bogus version → curl 404 failure
• OCI labels match existing image patterns
• CI workflow structure matches headless/spt-server workflows

Implemented with the help of Claude Code