[codex] Add GHCR preflight check for main image publish

[wickedyoda]

Summary

• add a GHCR package-access preflight step before the main image build/push
• fail early with a clear permissions message when the workflow can authenticate but cannot access ghcr.io/yacht-sh/yacht
• allow 200 and 404 so first-time package creation is not blocked

Root cause

The image build is succeeding, but the workflow fails late in docker/build-push-action because GHCR returns 403 Forbidden for the existing ghcr.io/yacht-sh/yacht package namespace. The agent image publishes successfully, so the failure is isolated to the main package access path.

Validation

• parse .github/workflows/build.yml with PyYAML
• syntax-check the new shell block with bash -n
• run git diff --check