fix: resolve bot bugs and modernize container deployment

[keryx-io]

Summary

Fixes 7 bugs found in a code review and modernizes the container deployment.

Bug fixes

• Stoll (Matrix): responses never sent as reply. isReply: mentions == null checked a list that is always initialized to [] and never null — so the condition was always false and messages with mentions were never sent with the reply relation. Mentions therefore never resolved to real Matrix notifications. Now replies when mentions are present. (Verified against RSMatrix's SendHtmlResponseAsync signature.)
• Stoll (Matrix): custom mention regex missed the @ prefix. <@alice:example.org> extracted alice:example.org (without @), but the channel user cache keys use the full @alice:example.org — mentions never matched. Now the @ is normalized.
• Stoll (Matrix): shutdown handled as error. OperationCanceledException during cancellation was caught by the generic catch, logged as an error and triggered a reconnect retry instead of a clean shutdown. Now handled with catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested) and a clean stop, including the reconnect delay path.
• Wernstrom (Discord): broken log interpolation. $"DiscordClientLog: ${message.Message}" contained a stray $ before the interpolation hole, logging a literal $.
• Wernstrom (Discord): roll command used new Random() per call (now Random.Shared) and did not support / as a range separator although the option description documents "space or slash". 3/6 now works.
• Wernstrom (Discord): channel cache race. Two concurrent messages in the same new channel could add duplicate cache entries (resolves a leftover TODO in the code).
• SqliteMessageCache: last_insert_rowid() never executed. The INSERT ...; SELECT last_insert_rowid(); multi-statement command is not executed reliably by Microsoft.Data.Sqlite (trailing statements are ignored) — the rowid query is now a separate command.

Deployment modernization

• Dockerfile.Wernstrom / Dockerfile.Stoll renamed to the conventional src/Wernstrom/Dockerfile / src/Stoll/Dockerfile; COPY now only pulls the project + shared library instead of the whole src/.
• Replaced push_wernstrom.sh / push_stoll.sh shell scripts with a GitHub Actions workflow (.github/workflows/docker-publish.yml) that builds both images and pushes them to GHCR on push to main, semver tags (v*) and manual dispatch.
• Added docker-compose.yml for local deployment (works with podman compose too); updated Makefile targets and .env_template accordingly.

Verification

• dotnet build: 0 errors (1 pre-existing warning in StollService.Reactions.cs).
• Unit tests (TUnit): 117/117 passed.
• docker-publish workflow: end-to-end tested on the fork — both images build and push to GHCR.
• The container build initially failed (MSB1003) because relative COPY destinations resolve against WORKDIR /src; fixed by using absolute destination paths and re-verified.