feat(ci): Add bentoctl Dockerfile and build/publish workflow

[nehan-p]

Adds a Dockerfile and GitHub Actions workflow to build and publish bentoctl as a Docker image, so it can be used as a k8s Job image to run bentoctl init-auth for Keycloak initialization.

• Adds Dockerfile: Python 3.14 base image, installs the Docker CLI and compose plugin via Docker's official apt repo (Debian's docker.io package doesn't ship a client binary), copies in lib/ and the compose files since config.py runs docker compose config at import time, sets up a venv, and creates a bentoctl shell alias
• Adds dev.Dockerfile: mirrors Dockerfile minus the py_bentoctl source copy, since dev images should have dependencies pre-built with the source mounted in as a volume for local iteration
• Adds .github/workflows/build.yml: builds and smoke-tests both the main and dev images, then publishes to ghcr.io/bento-platform/bentoctl via bento_build_action on pushes/PRs to main and published releases
• Fixes init-auth's hard dependency on a Docker daemon (fix(bentoctl): init-auth external provider #361): docker_client is now optional in auth_helper.py, entry.py only builds a Docker client when BENTOV2_USE_EXTERNAL_IDP is false, and a new BENTOV2_AUTH_CREATE_TEST_USER env var allows test user creation to be forced on for external IdPs
• Fixes a second Docker Compose dependency in config.py: service enumeration via docker compose config ran unconditionally at import time and crashed without a full local Compose environment. Adds a new BENTO_PLATFORM env var (docker/kubernetes) to skip this when not running under Docker Compose

Testing: Built and ran both images locally, confirming the smoke test passes with exit code 0 for each. Also rebuilt the image with the init-auth fixes and confirmed bentoctl init-auth no longer crashes on docker.from_env() or docker compose config when run with BENTOV2_USE_EXTERNAL_IDP=true and BENTO_PLATFORM=kubernetes — it proceeds into the real Keycloak auth flow and successfully reaches the point of making an authenticated request against a live Keycloak instance.

Closes #359
Closes #361

[v-rocheleau]

Small request, otherwise looks good!

[v-rocheleau]

1 small change, otherwise lgtm!

[v-rocheleau]

LGTM! Nice work

Not approving right now just because I want to wait before merging to see if we ship this with the next release.
We'll discuss that at the brainstorm meeting tomorrow!

[v-rocheleau]

One small change request.

Testing the full pipeline now with published bentoctl images

[v-rocheleau]

Just had a flash

[v-rocheleau]

request: just realised, we need a way to specify the namespace for secrets creation via an env variable.

We can default to "default" for dev use cases, but in prod clusters the services will not be deployed in the default namespace. The ServiceAccount, ClusterRole, etc will need to be adapted to that namespace as well in a prod cluster.

I suggest we use this env var BENTO_K8S_NAMESPACE for this and use this value here.