chore: align repo with owncloud-docker org conventions and unblock image publishing

[DeepDiver1975]

Why

ocis-workflows was created as a standalone image-build repo and just moved into
owncloud-docker. It never went through the org's repo-setup conventions: seven files
that every other active repo in the org carries are missing, and one config diverges.

Auditing it surfaced a harder problem: the image has never been published. Docker Hub
returns object not found for owncloud/ocis-workflows, and Docker CI has failed on
every run on main since the repo was created. This PR fixes the cause.

What

Org conventions

Copied verbatim from owncloud-docker/ocis (confirmed byte-identical org boilerplate):

• CODE_OF_CONDUCT.md, SUPPORT.md, .renovaterc.json, .gitignore, .github/CODEOWNERS

Adapted for this repo:

• CONTRIBUTING.md — shared preamble and "Pull requests" section kept verbatim; "About
  this repository" rewritten to describe the two-deployables-one-image arrangement and to
  direct application bug reports upstream to owncloud/ocis-workflows.
• agents.md — same section structure as ocis/agents.md, with this repo's specifics:
  the three-stage Dockerfile.multiarch, rolling-only tagging with no version matrix yet,
  and the NOTICE.md / LICENSES/ third-party attribution.

.github/dependabot.yml dropped its docker ecosystem. No sibling declares one;
IMAGE-LIFECYCLE.md assigns Docker digests to Renovate and GitHub Actions to Dependabot.
Renovate's onboarding PR #4 exists precisely because .renovaterc.json was absent, and
should close itself once this lands.

The Trivy failure

The pinned golang:1.26-alpine digest was Go 1.26.5, so the binary carried eight HIGH
stdlib CVEs and the publish gate failed every time:

CVE	Component
CVE-2026-33818	encoding/asn1 DoS
CVE-2026-39821	x/net/idna privilege escalation
CVE-2026-46600	x/net/dns/dnsmessage DoS
CVE-2026-56853	net/http unencrypted HTTP/2 DoS
CVE-2026-56858	html/template XSS
CVE-2026-56859	encoding/xml DoS
CVE-2026-56860	net/url quadratic complexity DoS
CVE-2026-56862	crypto/tls KeyUpdate DoS

All eight are fixed in Go 1.26.6; the new digest is Go 1.26.7. alpine:3.24 was already
current and is untouched. node:24-alpine is bumped too — build-only stage, no CVE impact,
but it leaves Renovate nothing stale to chase on its first run.

.trivyignore is deliberately unchanged. These findings have fixes, and per
IMAGE-LIFECYCLE.md §4 a .trivyignore entry is for unfixable or false-positive findings
only.

Verification

Built locally with the CI build args and confirmed the toolchain fix directly:

$ go version -m /usr/local/bin/app
/app: go1.26.7

Smoke test, as CI runs it:

$ curl -fsS -o /dev/null -w 'HTTP %{http_code}\n' http://localhost:9109/healthz
HTTP 200

A local Trivy run exits 0, but that is not evidence on its own — my local vuln DB is
from 2026-06-05 and a control scan of the known-vulnerable Go 1.26.5 base also reports
Total: 0. A fresh DB download is blocked here (ghcr.io denied), so CI's Trivy job is
the real gate. The go1.26.7 result above is the load-bearing evidence.

Follow-ups, not in this PR

• Confirm the Docker Hub push after merge. Run 31288029995 passed build, Trivy and
  smoke test, then failed at Login to Docker Hub with Username and password required.
  Org DOCKERHUB_USERNAME and DOCKERHUB_TOKEN are now both visibility: all, so it
  should be resolved — but it has never been observed working for this repo. If it fails
  again, or the push is rejected because the Docker Hub repository does not exist yet, that
  needs a manual Docker Hub step rather than a CI workaround.
• owncloud-docker/.github — docs/IMAGE-LIFECYCLE.md does not mention this repo.
  Separate PR.
• owncloud-docker/admin — safe-settings enrolment (topics, labels, team access,
  rulesets). Deferred until safe-settings is live. Worth noting: this repo is the first in
  the org whose image build can be gated as a required check, because it has no version
  matrix embedding a release number in the job name.

Deliberately left alone

• The permissions: blocks in both workflows and the [LICENSES/*] stanza in
  .editorconfig. No sibling has the former; this repo is stricter, not wrong. Porting that
  hardening to the siblings is worth doing separately; weakening it here is not.
• No CHANGELOG.md and no .github/issue_template.md — matching ocis, the most recently
  modernised repo in the org. SUPPORT.md supersedes the issue template, whose sibling
  copies point at retired channels.

🤖 Generated with Claude Code

[LukasHirt]

Haven't we moved away from renovate in favour of dependabot?

[DeepDiver1975]

Not yet in this orga. Open task. Until then: consistency