ci: keep docker bake cache and build targets in one solve

[jleni]

Summary:

• keep consumer-defined Docker Bake cache configuration intact during publish jobs
• replace per-target bake execution with a single bake solve for all resolved targets
• keep the earlier docs clarifications about the shared workflow contract

Why:

• the current reusable workflow disables cache with CLI overrides (--set "*.cache-from=" and --set "*.cache-to=")
• it also loops over resolved bake targets one-by-one, which repeats shared builder work across targets
• in Omega this caused repeated COPY . ., bun run build, and bundle steps inside one release job

Behavior change:

• release builds now run one docker buildx bake invocation for the resolved target set
• registry-backed cache from consumer docker-bake.hcl files is preserved instead of being blanked by the workflow
• metadata/digest collection still happens per resolved target after the build completes

Testing:

• inspected the completed Omega release log for Zondax/omega run 24508764392
• verified the reusable workflow was disabling cache and rebuilding targets one-by-one
• patched _publish-docker-bake.yaml locally on this PR branch and confirmed the diff is clean