feat(docker): modernize and harden the multi-architecture node workflow

[3for]

What does this PR do?

• Modernizes the maintained Docker workflow for amd64 and arm64.
• Supports local and remote image builds with source-aligned Mainnet configuration.
• Runs FullNode as a non-root user and improves persistent-data protection.
• Updates Mainnet/private-network behavior and removes the outdated Nile mode.
• Adds dedicated Docker build, runtime, and smoke-test CI.
• Updates the related deployment and migration documentation.

Why are these changes required?

The existing Docker workflow had fallen behind current java-tron development. It ran nodes as root, lacked consistent multi-architecture validation, and could use configuration from a different source than the node binary.

These changes provide a safer, reproducible, and maintainable first-party Docker workflow.

This PR has been tested by:

• Unit Tests

  • Docker helper and lifecycle regression tests
  • CI selector and gate tests
  • Build-context filtering tests
  • JVM options and launcher tests
  • ShellCheck and Bash syntax checks

• Manual Testing

  • BuildKit validation for both Dockerfiles
  • Real Docker build-context filtering
  • Runtime permission and restrictive umask checks
  • Mainnet/private configuration and container lifecycle verification

Follow up

• Publish a compatible versioned non-root multi-architecture image.
• Pin JDK/runtime dependencies and improve image provenance metadata.
• Expand Docker CI selection to cover all distribution inputs.
• Handle standalone start.sh hardening in a separate PR.

Extra details

This is a compatibility-affecting change. Existing data created by root-based images may require a one-time ownership migration.

The helper defaults to a locally built image because the current official latest image does not meet the new non-root runtime contract. Nile nodes should continue using the Nile-specific repository and tron-docker workflow.

This PR builds and validates images but does not publish them.