Wire docker-images workflow into the ci.yml release chain

## Motivation

Images must be baked automatically for every release tag, reusing the wheels the release pipeline already builds instead of rebuilding them.

## Details

1. In `.github/workflows/ci.yml`, add a `build-docker-images` job: `needs: [build-wheels]`, `if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')`, `uses: ./.github/workflows/docker-images.yml` — same pattern as the existing `build-sbom` job.
1. Ensure `permissions`/`secrets`/`vars` propagate correctly through the `workflow_call` boundary (`id-token: write` must be granted at the caller job).
1. Decide and document whether `make-final-release` should wait for image publication (`needs`) or run independently — recommendation: independent, so a Docker Hub outage does not block the PyPI/GitHub release.

Depends on: BA-7268.

## Impact

- Release pipeline gains one job chain; no change to existing jobs' behavior.

## Success Criteria

- Tag push runs wheel build → image build/push automatically.
- Failure of the image job does not corrupt or block unrelated release artifacts (per the decision in step 3).

JIRA Issue: BA-7269

Start in .github/workflows/ci.yml by reading the existing build-sbom job, build-wheels job, and make-final-release job, then inspect .github/workflows/docker-images.yml for its workflow_call inputs and permissions. Add the tag-triggered build-docker-images chain, verify permissions, secrets, and vars across the call boundary, and document whether make-final-release waits for image publication; confirm tag pushes build wheels and images without blocking unrelated release artifacts.

Written by the indexing model from the issue text.