Add Dockette CI rollout baseline - #2

Added CI fix commit: rebase Expose image from Buster/PHP 8.0 to Bullseye/PHP 8.2.

Suggested change: run CI on PRs, but keep publish strictly master-only

Right now this workflow has no pull_request trigger, so the Test job never validates the PR — and the publish (Build) job calls the reusable workflow with secrets: inherit with no master guard. Adding pull_request without guarding the publish job would expose registry secrets on every PR.

Two changes fix both:

 on:
 workflow_dispatch:
+
+ pull_request:
 push:
 branches: ["master"]
@@
 build:
 name: "Build"
 needs: ["test"]
+ if: github.ref == 'refs/heads/master'
 uses: dockette/.github/.github/workflows/docker.yml@master
 secrets: inherit

Result: a PR runs only the Test job (builds the image locally with load: true, runs make test, no secrets); Build (publish) and Docs run only on master. This matches the canonical shape already used in dockette/mockbin#2 and dockette/perl#2.