feat(ci): publish verified runner images

[Windsor Nguyễn (windsornguyen)]

Summary

This change adds a Hollywood-generated workflow that verifies the runner image on native x64 and arm64 runners and publishes an attested multi-architecture image to GHCR.

Pull request jobs inspect and verify the image with read-only permissions. A trusted push to main or a published GitHub release can publish the image.

Evidence

• The generated matrix covers Docker and Podman on native x64 and arm64 runners.
• Stable and prerelease tag tests verify the expected alias set.
• The workflow requests package and OIDC write permissions only for the publication job.
• The workflow has not published an image from this pull request. GHCR publication begins after the change reaches main or a matching release tag.

Tests

• npm run lint.
• npm run typecheck.
• npm test.
• npm run build.
• npm run check.
• npm run package.
• npm audit --audit-level=high.
• npm audit signatures.

Compatibility

A push to main publishes sha-<git-sha> and edge. A stable release publishes the source tag, exact version, compatible minor version, latest, and ubuntu-24.04. A prerelease publishes only the source tag and exact prerelease version.

GitHub creates a new organization package with private visibility by default. An organization owner must make the package public once. The anonymous digest pull fails while the package is private.

Review focus

Review job permissions, release and package version equality, stable and prerelease aliases, architecture-specific cache scopes, provenance verification, and anonymous digest access.

[cind-bot]

Here's a flower for all your hard work! 🌸