P1 E9 F9.1b: Publish signed multi-arch hub OCI images

[gnanirahulnutakki]

Parent: #27 (E9 F9.1 follow-up after #129, #131, #133, and #135)

Problem

The repository has an intentionally fail-closed Helm contract and deterministic local OCI-image checks, but no release-bound registry image. The chart therefore correctly refuses to claim a public install. A digest-addressed, signed multi-architecture hub image is the smallest missing artifact between the existing chart contract and an honest install path.

Scope

• Extend the existing signed, main-ancestry tag release workflow to publish one Linux multi-platform hub image to GHCR from the exact release source, covering linux/amd64 and linux/arm64.
• Make the published manifest digest the only documented Helm consumption value. Version tags may exist for discovery but no latest or mutable-tag installation contract is introduced.
• Preserve the existing non-root, pinned-distroless Containerfile contract. The image contains only the existing sith binary and no secret, kubeconfig, certificate, database URL, or default runtime configuration.
• Use the workflow GitHub token only for GHCR publication; use GitHub OIDC for keyless Cosign signing and GitHub artifact provenance/SBOM attestation of the pushed manifest. Pin every added action by full commit SHA.
• Fail closed on missing/ambiguous platform digest, wrong release ref, unsigned tag, failed signing/attestation, or failure to make the manifest available before the GitHub release becomes public.
• Add deterministic policy/unit coverage for image naming, digest-only documentation, and workflow wiring. Extend the release verification guide with exact digest, Cosign identity, and GitHub attestation checks.

Acceptance

• A release tag produces a public-or-explicitly-documented GHCR manifest list with exactly linux/amd64 and linux/arm64 variants, each resolving the expected immutable runtime contract.
• The manifest digest is keylessly signed by the exact Sith release workflow identity and has GitHub build provenance plus SBOM attestation; verification commands succeed against the published digest.
• The release fails rather than publishing a GitHub release without the verified image evidence.
• Helm documentation consumes only ghcr.io/ardurai/sith-hub@sha256:; no latest, tag-only install example, credential literal, KMS provider, database subchart, or ingress is added.
• Unit/race, CI, Helm contract, isolation, release-check, real two-cluster tests, red-team review, security queues, signed/DCO/GSTACK PR, and exact post-merge CI are green.

Explicit non-goals

F9.2 addon packaging, E3 secret/KMS materialization, a database subchart, real Helm install with production credentials, profiles beyond the existing bounded envelopes, air-gap bundles, or a browser console.

[gnanirahulnutakki]

Implemented and landed in dev.

• PR feat(e9): publish signed hub OCI image #170 merged as 6fe30e0.
• Exact dev CI 29386796797 passed: reproducible archives, SPDX SBOM, Homebrew formula, full race/isolation suite, and real two-cluster kind fan-out.
• Required local validation also passed: make ci, make release-check, make e2e-isolation, make e2e-oci, and make e2e-kind.
• Supply-chain queues at closure: Dependabot 0, code scanning 0, secret scanning 0.

Next: promote this coherent dev increment as v0.3.0-beta.4 and verify the release-bound GHCR manifest, keyless signature, SBOM, and provenance assets.