fix(ci): build image before NGC login so base image pulls anonymously

[nv-mtucciarone]

Problem

Release builds fail while pulling the NVIDIA base image:

load metadata for nvcr.io/nvidia/distroless/static:v4.0.0
ERROR: failed to authorize: failed to fetch oauth token: denied: Access Denied

A scoped NGC key returns 403 for anything outside its own namespace rather than falling back to anonymous. Because the workflow logged into nvcr.io before building, the base image — which is public and pulls fine with no credentials — became unreachable.

Change

Build first, authenticate after:

• NGC login moved below the build step, so the base image pull stays anonymous
• push: true → push: false + load: true, with a separate docker push step
• Enable the containerd image store — the classic Docker image store holds one architecture per tag, so load: true cannot accept a multi-arch build without it

No change to what gets published: same three tags, same registries, still linux/amd64,linux/arm64.

Validation

Verified on this branch using a temporary push trigger (since removed). The run completed green and the image published to both registries:

ghcr.io/centml/simple-sidecar:test-9abbcd6
nvcr.io/0808839837694695/simple-sidecar:test-9abbcd6   sha256:1ea8cf7f…