Fix Public ECR release tag publishing

[gontzess]

Why

The Public ECR tag helper currently calls aws ecr-public batch-get-image, but ECR Public does not expose that AWS CLI operation. Go connector releases with Docker enabled can push and sign the temporary candidate image, then fail before the version tag, manifest publication, and registry recording.

What this changes

Fetch the candidate manifest through Docker registry tooling with docker buildx imagetools inspect --raw <image>@<digest>, then keep the existing ECR PutImage promotion and post-write digest assertion. The helper now passes the expected candidate digest into PutImage, refuses to send non-release-candidate-<run>-<attempt> tags to BatchDeleteImage, and the tests model AWS and Docker separately so the fake AWS runner no longer accepts an invalid ECR Public command.

Cleanup remains best-effort: if BatchDeleteImage is denied, release publication still succeeds after the real version tag and latest are written and verified.

Validation

• go test ./cmd/publish-public-ecr-release-tags
• make test
• Read-only check against the failed HubSpot candidate image confirmed the raw manifest hash matches the pushed candidate digest.