Publish source-ordered Trino image releases

[benben]

Description

Build the Trino image once, publish it to immutable ECR, and mirror the exact digest to GHCR. Source-ordered tags and index-level OCI source/revision annotations identify the built commit. ECR is the release source for new cells; GHCR retains the existing full-SHA and manual readable aliases. Existing charts state dispatch remains enabled for master pushes, but only after both registries pass digest read-back. Merging this PR therefore starts the existing build-and-dispatch path and can roll the existing dev Trino deployment, independently of the new empty cells.

Publication is limited to master pushes and manual runs on master, with master-scoped AWS OIDC credentials. Retries reuse a verified ECR release or its immutable source-annotated raw staging image. A failed GHCR mirror resumes from ECR without rebuilding. Existing immutable aliases must match exactly; readable aliases exist only in GHCR. Tag-push publication is removed; manual master runs retain readable aliases. Pull requests run contract tests without package-write or OIDC permissions.

Additional context and related issues

• The registry and publisher-role infrastructure has been applied. Organization-level Actions secret AWS_ECR_PUBLISH_IAM_ROLE is configured and its metadata confirms availability to this repository. Its operator-supplied value has not been independently verified or read back. The workflow masks the account ID and derives the ECR address from authenticated login; no real account ID is hard-coded in the current source or this description. No image publication or deployment was triggered during this setup.
• Add root AGENTS.md with public-repository data-handling rules, synthetic-example requirements, runtime-secret guidance, and links to the existing development conventions.
• Nineteen local contract tests pass: publication and retry safety, source/registry guards, registry failures, reserved-alias protection, OCI validation, default/OCI build execution, raw-stage recovery, partial ECR/GHCR publication, immutable conflicts, mirror read-back failure, and GHCR-only readable aliases. Selective lookup and provenance failures cannot fall back to a valid staged image.
• The publisher uses an explicit Buildx docker-container driver with type=registry,oci-mediatypes=true before creating the annotated index. Default local Docker builds remain unchanged. Buildx applies index annotations only to OCI indexes; BuildKit documents the OCI media-type exporter flag. Digest aliases use Buildx's single-source copy behavior without annotations, preserving the original index bytes.
• Pinned Actionlint v1.7.7, Bash syntax validation, and diff whitespace checks pass.
• Local Maven validation was attempted but the installed Homebrew JDK is rejected by the repository's Temurin/Oracle vendor requirement. No Java code changes.
• Tests mock registry commands. No image was published, release dispatched, or registry permissions changed during this work. An eligible real artifact must be verified after the first authorized publication.
• Workflow serialization and retry checks do not themselves establish registry trust. Verify applied ECR immutability, protected source history, and effective writer permissions before enabling release discovery. GHCR is a compatibility mirror, not the new cells' trusted release source; see .github/TRINO_IMAGE_RELEASES.md.

Release notes

(x) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
( ) Release notes are required, with the following suggested text:

[bill-ph]

Reviewed the current head and available CI status; no P0 blockers requiring code changes found. Remaining CI jobs are still in progress.\n\n— Robo Bill