fix(ci): stop container image releases from failing silently

[muscariello]

Root cause

The slim-v3.0.0 and slim-v3.0.1 images were never published. Both pushes failed with denied: installation not allowed to Write organization package.

#2032 ("Scorecard: add explicit top-level permissions to workflows missing one") added this to reusable-docker-build-push.yaml:

permissions:
  contents: read

For a reusable workflow that top-level block is the complete list: every scope it leaves out becomes none, however much the caller grants. release-images.yaml still granted packages: write, and it was silently dropped.

Nothing caught it. docker/login-action succeeds without write access, so the failure lands at the very end of a ~20 minute build. actionlint and zizmor do not model this interaction. And because images are only pushed from release tags, no run exercised the push path between the change and the release.

#2155 restored the grant. This PR removes the shape that invited the mistake, and makes the push path run often enough to fail on the commit that breaks it.

Changes

reusable-docker-build-push.yaml

• Top-level block stays empty; the grants live on the job, next to the steps that need them.
• The token comes from github.token instead of being passed as a secret, and the github-token input is gone. A reusable workflow already receives GITHUB_TOKEN with the caller job's grants, so the hand-off was never load-bearing — only the caller's packages: write is.
• push and ref are explicit inputs rather than inferred from github.event_name/github.ref.
• After pushing, every tag is read back with docker buildx imagetools inspect, so a green run means pullable images.

ci.yaml

• Merges to main now push the main tag. This runs the same login→build→push→verify path a release takes, so a broken grant or credential fails on the merge that caused it instead of weeks later. The tag moves rather than accumulating, so it costs one tag of storage.
• This also closes a latent gap: ci.yaml never passed github-token, so the login step would have failed with an empty password the first time it tried to push. Taking the token from github.token fixes that by construction.

release-images.yaml

• workflow_dispatch with a tag input rebuilds an existing release tag using the workflow on the selected branch. Re-running a tag run replays the workflow as it was at the tag, so today there is no way to rebuild slim-v3.0.1 with the fix. The tag is validated and passed through env.
• latest is opt-in for manual rebuilds, so rebuilding an older tag does not move latest back onto it.
• New report-failure job opens an issue (or comments on an open one) when a release image build fails, since the failure comes after crates, tags and the GitHub release are already out.
• Dropped attestations: write, which nothing uses (provenance: false, no attest step).

An earlier revision of this PR added a Python lint check that re-implemented GitHub's permission rules. Dropped in favour of the :main push, which tests the real thing instead of a model of it.

Test plan

• actionlint and zizmor --offline clean on all changed workflows
• Tag regex and target/version parsing checked locally against real tags (slim-v3.0.1, slim-control-plane-v3.0.1, slim-channel-manager-v3.0.1, control-plane-v2.0.0-alpha.12, crate tags such as slim-config-v0.16.5); malformed input rejected
• On merge, ci-ci / Build SLIM docker image should push ghcr.io/agntcy/slim:main and pass the verify step — this is the real test of the push path
• Then rebuild the missing v3.0.1 images:
  • gh workflow run ci-release-images -f tag=slim-v3.0.1 -f latest=true
  • gh workflow run ci-release-images -f tag=slim-control-plane-v3.0.1 -f latest=true
  • gh workflow run ci-release-images -f tag=slim-channel-manager-v3.0.1 -f latest=true

Note: ci.yaml builds only the slim bake target, so the merge-time check covers that image. The control-plane and channel-manager images still build only at release, but they share this workflow, so a permission regression fails on main first.

Not in this PR: slimctl aarch64-pc-windows-msvc in release-rust.yaml fails on cosign ("unsupported architecture ARM64"), which skips the Homebrew cask job.