feat(labctl): add secrets output and container publishing

[jmgilman]

Summary

• add labctl secrets get --format yaml|json and --output/-o with atomic 0600 file writes
• add JSON rendering tests and testscript coverage for stdout/file output
• add a Chainguard static labctl image, GoReleaser digest wiring, and post-published-release GHCR image workflow

Validation

• go test ./...
• moon run labctl:check --summary minimal
• moon run labctl:image-smoke --summary minimal
• goreleaser check
• goreleaser release --snapshot --clean --skip=publish
• actionlint .github/workflows/publish-labctl.yml .github/workflows/publish-labctl-image.yml .github/workflows/labctl-release-dry-run.yml
• git diff --check