ci: add build-guest workflow for manual trigger with optional release

Author: kvinwang

.github/workflows/build-guest.yml

@@ -0,0 +1,45 @@
+name: Build Guest Images
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to create and release (e.g. v0.5.9). Leave empty to build only.'
+        required: false
+        default: ''
+        type: string
+
+jobs:
+  build:
+    runs-on: yocto-builder
+    timeout-minutes: 480
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Reproducible build
+        run: cd repro-build && ./repro-build.sh -n
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: guest-images
+          path: |
+            repro-build/dist/*.tar.gz
+            repro-build/dist/reproduce.sh
+          retention-days: 30
+
+      - name: Create tag and release
+        if: inputs.tag != ''
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ inputs.tag }}
+        run: |
+          git tag "$TAG"
+          git push origin "$TAG"
+          gh release create "$TAG" \
+            repro-build/dist/*.tar.gz \
+            repro-build/dist/reproduce.sh \
+            --title "$TAG" --generate-notes