Add zero-config build path for Node.js apps

[runleveldev]

Summary

Adds a build path to LaunchPad so a Node.js repo can be deployed with zero configuration, while keeping the existing pre-built-image path. When template_name is omitted on a manage event, LaunchPad now builds the checked-out repo into a systemd-enabled image, pushes it to ghcr.io/<owner>/<repo>/launchpad:<sha>, and deploys it.

This PR contains two logical parts:

1. Refactor: dispatcher + sub-actions (no behavior change)

The monolithic action.yml is split into a dispatcher plus three composite sub-actions, referenced via the self-repo $/manage / $/delete / $/build syntax (resolves this repo at the running commit):

• manage/ — create/recreate the container and report status
• delete/ — remove the container on branch delete / PR close
• build/ — build & push the application image

2. Build path

• build/Dockerfile — a default lifecycle image based on ghcr.io/mieweb/opensource-server/docker-nodejs:latest. Stages: Dependencies (dependency_command) → Configure/Build (build_command) → Install (copy repo + install & enable the unit) → Run (run_command via app.service).
• build/app.service.in — systemd unit template rendered with envsubst (explicit variable allow-list, so values like $PORT survive verbatim). Documentation= is set to the repo URL; env vars load from /etc/environment.
• New inputs (all optional): image, base_image, working_directory, dependency_command, build_command, run_command. New output: image.
• CI (.github/workflows/test.yml): validates all action metadata, lints workflows, and runs a fixture build test asserting the rendered/enabled unit.

Breaking change

Previously, omitting template_name on a manage event reused an existing container as-is. It now builds and deploys from the repository. Cleanup events (PR close / branch delete) are unaffected — they never build.

Caller requirements (build mode)

• Run actions/checkout before the action
• permissions: contents: read, packages: write
• Public repo (so the GHCR package inherits public visibility for anonymous cluster pulls)

Testing

• action-validator passes on all four action.yml files
• actionlint clean
• test/build-test.sh passes both scenarios (defaults + overrides); verified WorkingDirectory, ExecStart, Documentation substitution, the multi-user.target.wants enable symlink, and $PORT verbatim survival

Note: CI here cannot exercise $/ sub-action resolution or a real deploy. A manual end-to-end run from a sandbox Node.js repo (image published & publicly pullable, container reaches running, app responds, cleanup on branch delete) is the recommended gate before advertising @main.