Improve Docker dependency PR workflow

[fqjony]

Summary

• request the udx/worker team on automated Docker dependency PRs
• apply explicit docker and dependencies labels when the updater creates a PR
• keep Build/Release validation on Docker/build/runtime branch pushes, matching the existing docker-ops trigger model
• include PR Bump actions/checkout from 6 to 7 in /.github/workflows #141: bump actions/checkout from v6 to v7 across workflow checkouts
• add issues: write to the updater job so create-pull-request can apply labels through the Issues API

Context

• PR chore(deps): docker dependency upgrade #140 already has the right labels and now has the Worker team requested, but the updater workflow did not encode that behavior explicitly.
• Build/Release already runs on push for all branches with Docker/build/runtime path filters. That is the intended validation path for updater branches before merge.
• The reusable Docker release workflow distinguishes release vs feature branches internally through release_branch, so the caller should not add pull_request execution with release-capable permissions and Docker secrets.
• Related internal context: icamiami/icamiami.org#1931 tracks Copilot-assisted package security checks for APT pins, Cloud SDK, and standalone binaries.

Validation

• Parsed updated workflow YAML with Ruby Psych.
• Ran git diff --check for the edited workflow files.

[Copilot]

Pull request overview

This PR improves the automated Docker dependency update workflow and ensures the Docker Build/Release workflow runs for PR validation when Docker/build/runtime-related files change (including updater-created PRs that don’t trigger push workflows).

Changes:

• Trigger Build/Release on pull_request to latest when Docker/build/runtime surfaces change.
• Add explicit PR labels (docker, dependencies) and request the worker team as reviewer for updater-created PRs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/docker-ops.yml	Adds a pull_request trigger (path-filtered) so Build/Release runs for PR validation, including automation PRs.
.github/workflows/docker-dependency-updater.yml	Adds explicit labels and a team reviewer request to the PR creation step for the dependency updater.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[fqjony]

Superseded by #143, which now keeps the worker changes in one PR and leaves reusable docker-ops gate hardening to udx/reusable-workflows.