infra: container-only workflow (packaging image + scripts); README: add No Host Pollution policy

scripts/packaging-exec.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+NAME=${PACKAGING_CONTAINER_NAME:-tsys-cloudron-packaging}
+
+if [[ $# -lt 1 ]]; then
+  echo "Usage: scripts/packaging-exec.sh <command...>" >&2
+  exit 1
+fi
+
+if ! docker ps --format '{{.Names}}' | grep -qx "$NAME"; then
+  scripts/packaging-up.sh >/dev/null
+fi
+
+exec docker exec -it "$NAME" sh -lc "$*"
+