[Chore] Run the deployment acceptance gate concurrently with image builds

[mrubens]

Problem

Merge-to-nightly latency is ~12 minutes plus per-branch queueing: the acceptance gate (~5 min) runs strictly before the build matrix (~5.5 min on the arm64 app critical path), even though the gate builds its own local images for the smoke test and consumes nothing from the build jobs.

Change

• build no longer depends on deployment-acceptance; the two run concurrently.
• publish now depends on [prepare, build, deployment-acceptance].

Protection is unchanged: build jobs only push untagged per-arch digests, and nothing is consumable until publish assembles the tagged manifests — which still cannot happen unless the gate passes. Expected wall clock drops to ~max(gate, builds) + manifests ≈ 7 minutes.

docs_only skip behavior is unchanged: when the gate is skipped, builds are also skipped by the same condition, so publish skips exactly as before.

[roomote-roomote]

No code issues found. See task

Reviewed the job-dependency rewiring in .github/workflows/publish-ghcr.yml. The change is sound:

• Dropping deployment-acceptance from build's needs is safe — there is no data dependency. The gate builds its own candidate images locally (docker buildx build --load → localhost/roomote/... in deploy/ci/deployment-smoke.sh) and pulls only the baseline from GHCR, so it consumes nothing from the build jobs.
• Adding deployment-acceptance to publish's needs preserves protection: build only pushes untagged per-arch digests, and tagged manifests are assembled solely by publish, which cannot run unless the gate passes.
• docs_only skip behavior is unchanged: build and deployment-acceptance share the same if condition, and a skipped needs propagates the skip to publish (and then notify-ops), so publish skips exactly as before.