Add affected app PR image builds

[kilemensi]

Description

This adds PR-time production image validation for apps that have migrated to the Docker bake build path.

For trusted PRs, the workflow detects which buildable apps are affected and builds only those app images without pushing them. This gives us a PR signal for production-image breakages without rebuilding every migrated app on every PR.

Behaviour

• Runs for PRs that touch build-relevant app, package, workflow, lockfile, or Docker bake files.
• Builds affected migrated apps only.
• Skips image builds for fork or otherwise untrusted PRs.
• Uses the published base image tag configured by UI_BASE_TAG.
• Does not validate docker/base.Dockerfile; base images remain on their separate release workflow.

Implementation Notes

• Adds a PR Build workflow for affected app image validation.
• Adds scripts/pr-build-targets.mjs to compute affected build targets using turbo ls --affected plus explicit build-input rules.
• Adds app-specific reusable build workflows:
  • _build-techlabblog.yml
  • _build-trustlab.yml
• Renames the generic bake workflow to _bake-and-push.yml and keeps it as the low-level reusable bake primitive.
• Updates techlabblog.yml and trustlab.yml to reuse their app-specific build workflows.
• Updates root test scripts so script-level tests run in CI.

Validation

pnpm test:scripts
pnpm exec turbo format:check

Fixes #1469

Type of change

• Chore

Screenshots

N/A

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation