Publish one release image digest from a modernised workflow

The push job called build-push-action twice, once for the ref tag and once
for latest. Two builds meant the two tags could resolve to different manifest
digests. Build once and let docker/metadata-action supply both tags and the
OCI labels for that single build.

Replace the deprecated actions/checkout@v2 and docker/build-push-action@v1,
default workflow permissions to contents: read so pull requests cannot reach
publication credentials, and authenticate with a scoped DOCKER_TOKEN through
docker/login-action instead of DOCKER_PASSWORD.

The test job's docker-compose.test.yml branch was dead; that file does not
exist in the repository.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

IMPROVEMENTS.md

@@ -147,12 +147,15 @@ Acceptance criteria:
 
 ### CI and release pipeline
 
-- [ ] Replace `actions/checkout@v2` and `docker/build-push-action@v1`.
-- [ ] Set workflow permissions explicitly to `contents: read` by default.
-- [ ] Use a scoped Docker Hub access token.
-- [ ] Build a release image once and attach all version and `latest` tags to
+- [x] Replace `actions/checkout@v2` and `docker/build-push-action@v1`.
+- [x] Set workflow permissions explicitly to `contents: read` by default.
+- [x] Use a scoped Docker Hub access token. The workflow now reads
+  `secrets.DOCKER_TOKEN`; the repository secret still has to be created from a
+  scoped Docker Hub token before the next tag is pushed.
+- [x] Build a release image once and attach all version and `latest` tags to
   the same manifest digest.
-- [ ] Add OCI labels, an SBOM, provenance, and image signing.
+- [x] Add OCI labels via `docker/metadata-action`.
+- [ ] Add an SBOM, provenance, and image signing.
 - [ ] Add dependency updates for Python, Docker, and GitHub Actions.
 - [ ] Run dependency and image scans on pull requests and on a schedule.