[SYNC: FVH → laurigates] Container stale-image guard + secret-build-args + OCI digest fix

[laurigates]

Backport: container build-once/promote stale-image guard + secret-build-args + OCI digest fix

Source: ForumViriumHelsinki/.github → reusable-container-build.yml + reusable-container-release.yml

Why

Fixes a real correctness bug. When main advances between the PR image being built and the release tag being pushed, the cached PR image is promoted unchanged and silently ships the wrong code. FVH bakes a build-context tree-hash label in the build job; the release job verifies it against the release commit's tree and falls back to a full rebuild when stale. Also adds:

• secret-build-args — masked secret Docker build args (e.g. Sentry/NPM tokens).
• OCI digest-extraction fix — {{.Manifest.Digest}} returns nothing for OCI index/manifest-list images and breaks $GITHUB_OUTPUT; replaced with a grep '^Digest:' parse + error guard.

How

The two files move together — the label is a contract between them.

Sanitization log

• Label fvh.build.context-tree → neutral namespace (e.g. io.github.laurigates.build.context-tree), identically in both files. Existing PR images lack the label → guard already falls back to rebuild with a warning (safe).
• image-name example forumviriumhelsinki/my-app → laurigates/my-app.
• cosign identity regexp https://github.com/ForumViriumHelsinki/ → .../laurigates/.
• Comment prose "FVH" refs → generic.

Verification

Org-agnostic once the label namespace matches across both files. Confidence: high.

---

Part of a feature-parity backport sweep between ForumViriumHelsinki/.github and laurigates/.github. Sanitization verified before any PR is opened; logic is org-agnostic.