Automate Docker Desktop extension validation before release

[ocularminds]

Context

The extension image is built, scanned, and published in CI, but docker extension validate still depends on a manual workstation check because hosted runners do not include Docker Desktop.

Scope

Add a trusted, repeatable validation path on a compatible runner and make it a required gate for ext-v* releases.

Acceptance criteria

• A compatible runner executes docker extension validate against the exact release candidate.
• The release cannot publish when extension validation fails or is unavailable.
• Runner trust, credential access, and cleanup behavior are documented.
• The validated image digest is recorded in the workflow summary.
• A safe dry-run path is documented for contributors without the specialized runner.