Enable reusable Windows image publishing for CCCL

[jrhemstad]

Summary

• expose the existing Windows release workflow through workflow_call with a caller-provided image repository
• explicitly check out the devcontainers workflow source for cross-repository calls
• retain Docker Hub authentication for native releases and use the caller's GITHUB_TOKEN for ghcr.io/*
• ensure Docker is running on GitHub-hosted Windows runners, while leaving RAPIDS self-hosted runners unchanged
• preserve the existing Windows matrix, runner selection, build/test/push flow, concurrency, and tag generation

This is the prerequisite for a SHA-pinned workflow in NVIDIA/cccl to publish Windows images to ghcr.io/nvidia/cccl.

Validation

• repository pre-commit checks pass
• the native PR workflow's full Windows matrix passed (14/14 jobs): https://github.com/rapidsai/devcontainers/actions/runs/33585538257
• a cross-repository caller in NVIDIA/cccl invoked this exact commit and passed build, test, push, and logout in all 14 GitHub-hosted Windows jobs: https://github.com/NVIDIA/cccl/actions/runs/33588715058
• the smoke package was associated with NVIDIA/cccl and contained the expected 28 versioned tags (14 base plus 14 -windows2022 tags), with no latest-* tags
• the disposable smoke package was deleted after validation

The failing Linux jobs in the PR run build current external RAPIDS sources and fail in cuDF on cuda::stream_ref::value(); they do not execute the changed Windows workflows. All Windows jobs and pre-commit checks passed.

Package visibility

Package visibility is caller-owned, not a registry-login concern. A new package created with the GITHUB_TOKEN inherits the caller repository's visibility, so a public NVIDIA/cccl caller would create a public package. The final package will therefore be bootstrapped once as private before the first CCCL publish, then the linked CCCL repository's GITHUB_TOKEN will be used for normal publishing. No PAT, App token, or Docker Hub secret is passed to this reusable workflow.

GitHub documents these defaults under Publishing and installing a package with GitHub Actions.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[jrhemstad]

/ok to test a7a1c60

[jrhemstad]

/ok to test f0d3eeb