fix: build PostGIS independently so trunk breakage can't block the pipeline - #161

Summary

PostGIS periodically fails to build against PostgreSQL trunk. Since it was built in the same docker buildx bake invocation as minimal/standard, a PostGIS-only failure took the whole build-pg job down with it -- blocking image publishing and, transitively, E2E testing (interim mitigation in #159 disabled PostGIS entirely; this is the long-term fix tracked in #158).

• docker-bake.hcl: create "default" group to build the postgres minimal/standard and keep postgis out of the "default" group matrix. A plain docker buildx bake (or bake --push) still only builds minimal/standard; docker buildx bake postgis builds it explicitly.
• reusable-build.yml: generalize the old minimal_tags/standard_tags inputs into a single targets input (one "<bake target>:<tags>" entry per line) so the workflow can build an arbitrary set of targets, and pass the parsed target names through to docker/bake-action's targets input (it only builds bake's default group otherwise). Add a best_effort input that sets continue-on-error on this workflow's own build/merge jobs -- GitHub Actions doesn't allow continue-on-error directly on a job that calls a reusable workflow via uses:, so the tolerance has to live inside the reusable workflow itself.
• build.yml, build-commitfest.yml, continuous-delivery.yml: add a build-postgis job, parallel to and independent of build-pg, calling reusable-build.yml with targets: postgis:... and best_effort: true. Nothing depends on build-postgis, so a PostGIS failure no longer affects minimal/standard publishing or E2E.
• README.md: document building the postgis target explicitly.
• Bump the ubuntu runner for arm to ubuntu-26.04-arm (all other ubuntu runner were already bump to 26.04)

Closes #158

Test plan

• docker buildx bake --print locally: default group resolves to minimal/standard only.
• docker buildx bake postgis --print locally: resolves postgis correctly, including with --set postgis.tags=... overrides matching what CI generates.
• actionlint run locally against all changed workflows: no syntax/expression errors (verified the continue-on-error-on-reusable-call restriction and worked around it).
• All workflow YAML parses.
• CI run on this PR builds minimal/standard/postgis (amd64 validation only, since this is a pull_request run) successfully.

🤖 Generated with Claude Code