chore: add composite action for container pull and cleanup

.github/actions/container-cleanup/action.yml

@@ -0,0 +1,17 @@
+name: Container Cleanup
+description: Remove container via container ID and clean up image caches.
+
+inputs:
+  container_id:
+    description: Container ID to be removed
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Cleanup container and images
+      shell: bash
+      run: |
+        docker rm -f ${{ inputs.container_id }} || true
+        docker image prune -a --force --filter "until=24h"
+        docker system df

.github/actions/ecr-authenticate/action.yml

@@ -0,0 +1,28 @@
+name: ECR Authentication
+description: Login to ECR, if image_uri is provided pull the image onto host runner.
+
+inputs:
+  aws_region:
+    description: AWS Region for docker image repository
+    required: true
+  aws_account_id:
+    description: AWS Account ID for docker image registry
+    required: true
+  image_uri:
+    description: Docker image URI to pull from ECR
+    required: false
+
+runs:
+  using: composite
+  steps:
+
+    - name: ECR login
+      shell: bash
+      run: |
+        aws ecr get-login-password --region ${{ inputs.aws_region }} | docker login --username AWS --password-stdin ${{ inputs.aws_account_id }}.dkr.ecr.${{ inputs.aws_region }}.amazonaws.com
+
+    - name: Pull image
+      if: inputs.image_uri != ''
+      shell: bash
+      run: |
+        docker pull ${{ inputs.image_uri }}

.github/actions/pr-permission-gate/action.yml

@@ -1,5 +1,5 @@
 name: PR Permission Gate
-description: Fails the workflow if the PR sender lacks the required repository permission
+description: Fails the workflow if the PR sender lacks the required repository permission.
 inputs:
   required-level:
     description: Minimum permission level required (read|triage|write|maintain|admin)