Add CD for Docker images

[rainest]

Our Docker org no longer grants access to developer accounts, only bots. This runs afoul of our current decK release process, where we build and push Docker images locally.

We need to add a CD-based Docker image build for tags to handle this instead.

Acceptance criteria

• [ ] GH Actions push the Docker tag to Docker Hub for semver Git tags, similarly to how it's done for KIC.