infra: container-only workflow (packaging image + scripts); README: add No Host Pollution policy

scripts/packaging-enter.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+NAME=${PACKAGING_CONTAINER_NAME:-tsys-cloudron-packaging}
+
+if ! docker ps --format '{{.Names}}' | grep -qx "$NAME"; then
+  scripts/packaging-up.sh >/dev/null
+fi
+
+exec docker exec -it "$NAME" bash
+