build: publish container attestations

[djwhitt]

Summary

• publish SPDX SBOM and maximum-mode SLSA provenance attestations for application, base, and runner images
• hand exact Buildx output digests between architecture builds and manifest publication instead of trusting mutable tags
• verify both predicates for amd64 and arm64 after publishing final multi-architecture tags
• verify versioned and latest release tags after retagging
• use immutable commit pins for every action touched by the security stack
• merge daily base/runner runs serially and from run-specific digest artifacts

Validation

• 18 focused Python tests pass
• checker accepts BuildKit OCI and legacy attestation-manifest forms, validates subjects when present, and requires SPDX plus SLSA predicates for both architectures
• live inspection confirmed Docker Hub's current provenance descriptor format; the checker correctly rejects the existing base tag because its SBOM predicate is absent
• full production Docker image build and runtime smoke check pass
• all changed workflows pass actionlint except the repository's custom Blacksmith runner-label diagnostic
• production Docker workflow passed (run 31849626334)

Residual rollout note

The post-push checker intentionally fails publication if Docker Hub does not expose both attestations. Full registry verification therefore occurs on the first publishing run after merge.

Stack

• Depends on ci: automate Docker base snapshot updates #3835
• This is security stack PR 4 of 4