feat(ci): publish release images to ECR with OCI provenance

[Z3r0Sum]

Summary

Every push to main now also publishes the container image to an immutable ECR repository with the OCI provenance that PostHog's delivery tooling discovers releases from, so deployments can follow per-commit image identities instead of the floating latest tag. The GHCR publication is untouched and remains the public distribution channel.

Held: do not merge until the release repository and its OIDC publish role exist and the AWS_ECR_PUBLISH_IAM_ROLE repository variable is set; until then the new job fails on the first push to main.

Changes

• A new release job promotes the image the build job pushed to GHCR into ECR by digest, so the released artifact is always the build CI exercised, never a second build from mutable external inputs. docker buildx imagetools create copies the platform manifests, layers and buildkit attestation manifests across registries (the Docker docs sentence that sources must live in the target registry is stale; buildx copies with referrers) and adds the index-level annotations during the copy. This depends on the phlower GHCR package staying public: the copy pulls it anonymously.
• The release image is tagged sha-<commit> plus a source-ordered r<first-parent position>-<sha6> alias. Each write is skip-if-present with digest read-back, so a rerun after a partial publish repairs the missing tag instead of failing on the immutable repository. If the build job itself reran and produced a fresh GHCR digest, the earlier ECR copy of that commit is deliberately kept and a warning is emitted.
• Index-level OCI annotations: the standard org.opencontainers.image.* set (revision, source, and so on) plus commit author, committer, subject (capped at 160 characters) and UTC committer timestamp. These annotation keys are a contract shared with other PostHog services; do not rename them.
• The ordered tag is computed fail-closed: if it cannot be derived and validated the job fails loudly rather than shipping an image that release discovery cannot see.
• Registry access uses GitHub OIDC (id-token: write lives only on the release job, which never runs on pull requests or tag builds) and the AWS account id is masked in logs; the registry hostname comes from the ECR login step rather than the workflow source.
• The build job (GHCR, latest, semver and short-sha tags) is unchanged apart from exposing its image digest as a job output.

Rollback

• Revert this PR. Images already pushed to the release repository are inert and can stay.