feat: add PHP 8.5 support and improve CI builds (#81)

* fix(renovate): pin PHP base images to digest-only updates

* feat(php85): add PHP 8.5 with Imagick and Composer

* ci: add php85 to build and PR matrices

* docs: update supported PHP version range to 8.5

* ci: enable GHA build cache for Docker image builds

* fix: address CR feedback — fix DOCKERFILE_PATH, renovate match, composer verify, drop python3-dev

* ci: use native arm64 runners for arm64 Docker builds

* ci: use build-by-digest with manifest merge for multi-arch images

Switch from direct per-arch push to a two-phase workflow:
1. Build phase pushes images by digest and uploads artifacts
2. Merge phase creates multi-arch manifest lists per PHP version

This ensures proper multi-arch manifest tags instead of
last-writer-wins race conditions between arch builds.

* fix: remove continue-on-error and suppress SC2046 shellcheck warning

Remove continue-on-error from build job so failed arch builds correctly
block the merge job from pushing incomplete manifests. Add shellcheck
disable directive for intentional word-splitting in manifest creation.

php85/Dockerfile

@@ -0,0 +1,43 @@
+# vim: set ft=dockerfile ts=2 sw=2 sts=2 et:
+FROM php:8.5@sha256:2d7a7e055947c398314250fb6d657c85979872c44ce9912b9dc9d1456439b0b3
+
+LABEL \
+  maintainer="Ismo Vuorinen <ismo@ivuorinen.net>" \
+  version="1.0" \
+  description="PHP 8.5 with Imagick and Composer"
+
+# Install PHP extensions and required libraries
+RUN \
+  apt-get update \
+  && apt-get install -y --no-install-recommends \
+  libicu-dev \
+  libxml2-dev \
+  libfreetype6-dev \
+  libjpeg62-turbo-dev \
+  libpng-dev \
+  libonig-dev \
+  libmagickwand-dev \
+  unzip \
+  && docker-php-ext-configure gd --with-freetype --with-jpeg \
+  && docker-php-ext-install -j$(nproc) \
+  bcmath \
+  intl \
+  mbstring \
+  pdo \
+  xml \
+  gd \
+  exif \
+  && docker-php-ext-configure pcntl \
+  && docker-php-ext-install pcntl \
+  && yes '' | pecl install imagick \
+  && docker-php-ext-enable imagick \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/* \
+  && curl -sS -o composer-setup.php https://getcomposer.org/installer \
+  && EXPECTED_HASH="$(curl -sS https://composer.github.io/installer.sig)" \
+  && ACTUAL_HASH="$(php -r "echo hash_file('sha384', 'composer-setup.php');")" \
+  && if [ "$EXPECTED_HASH" != "$ACTUAL_HASH" ]; then echo 'Composer installer corrupt'; rm composer-setup.php; exit 1; fi \
+  && php composer-setup.php --install-dir=/usr/local/bin --filename=composer \
+  && rm composer-setup.php \
+  && php --version \
+  && composer --version