ci: publish multi-arch supervisor image on mvp branch

Add build-and-push-supervisor job to publish.yml so the supervisor
image is built for linux/amd64 and linux/arm64 and pushed to
ghcr.io/kagenti/openshell/supervisor on every push to main/mvp.

Also scope the GHA build cache by job (gateway vs supervisor) to
prevent cache key collisions between the two parallel jobs.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Paolo Dettori <dettori@us.ibm.com>

Author: pdettori

.github/workflows/publish.yml

@@ -1,4 +1,4 @@
-name: Publish Gateway Image
+name: Publish Images
 
 on:
   push:
@@ -14,7 +14,6 @@ permissions: {}
 
 env:
   REGISTRY: ghcr.io
-  IMAGE_NAME: ghcr.io/kagenti/openshell/gateway
 
 jobs:
   build-and-push:
@@ -47,7 +46,7 @@ jobs:
         uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf  # v6.0.0
         continue-on-error: true
         with:
-          images: ${{ env.IMAGE_NAME }}
+          images: ghcr.io/kagenti/openshell/gateway
           tags: |
             type=ref,event=tag
             type=sha,prefix={{branch}}-,enable=${{ github.ref_type != 'tag' }}
@@ -64,7 +63,7 @@ jobs:
         if: steps.meta.outcome == 'failure'
         uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf  # v6.0.0
         with:
-          images: ${{ env.IMAGE_NAME }}
+          images: ghcr.io/kagenti/openshell/gateway
           tags: |
             type=ref,event=tag
             type=sha,prefix={{branch}}-,enable=${{ github.ref_type != 'tag' }}
@@ -80,5 +79,71 @@ jobs:
           platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta_retry.outputs.tags || steps.meta.outputs.tags }}
           labels: ${{ steps.meta_retry.outputs.labels || steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-from: type=gha,scope=gateway
+          cache-to: type=gha,scope=gateway,mode=max
+
+  build-and-push-supervisor:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4.0.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4.0.0
+
+      - name: Log in to ghcr.io
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121  # v4.1.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf  # v6.0.0
+        continue-on-error: true
+        with:
+          images: ghcr.io/kagenti/openshell/supervisor
+          tags: |
+            type=ref,event=tag
+            type=sha,prefix={{branch}}-,enable=${{ github.ref_type != 'tag' }}
+            type=raw,value=latest,enable=${{ (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' }}
+
+      - name: Wait before retry
+        if: steps.meta.outcome == 'failure'
+        run: |
+          echo "Metadata extraction failed, retrying in 15s..."
+          sleep 15
+
+      - name: Retry Docker metadata
+        id: meta_retry
+        if: steps.meta.outcome == 'failure'
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf  # v6.0.0
+        with:
+          images: ghcr.io/kagenti/openshell/supervisor
+          tags: |
+            type=ref,event=tag
+            type=sha,prefix={{branch}}-,enable=${{ github.ref_type != 'tag' }}
+            type=raw,value=latest,enable=${{ (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' }}
+
+      - name: Build and push supervisor image
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f  # v7.1.0
+        with:
+          context: .
+          file: deploy/docker/Dockerfile.images
+          target: supervisor
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta_retry.outputs.tags || steps.meta.outputs.tags }}
+          labels: ${{ steps.meta_retry.outputs.labels || steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=supervisor
+          cache-to: type=gha,scope=supervisor,mode=max