Support better testing with Docker

[mjmaurer]

gha cache only works from main branch or children.

With either gha or ECR cache, we should:

• On main branch push: Build and cache the test images whenever the Dockerfile changes
• On PR push: Build and run from those test images