ci: use central release image signing

[devkoriel]

Summary

• Wire this repo image publishing workflow into the shared RFC-044.3 release image signing path.
• Use the central Docker builder or signer from chronicleprotocol/actions-workflows.
• Keep signing release-only on tag paths and preserve existing build inputs/tags.

Verification

• actionlint on changed workflow file(s)
• git diff --check origin/main
• Local pre-push hooks were allowed to run; any failures were unrelated repo test/setup failures, not workflow syntax.