fix: authenticate registry before image attestation

[mldangelo-oai]

Summary

• authenticate to GHCR before pushing the verified image provenance attestation
• preserve the existing protected release, OIDC signing, immutable digest, and stable-tag promotion gates

Evidence

• production container-release run 30582841027 passed both native publication jobs and multiarchitecture manifest verification, then failed with Error: No credentials found for registry ghcr.io
• validated workflow YAML and Prettier formatting
• regression check confirms GHCR authentication executes before provenance signing
• git diff --check passes

[mldangelo-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 91c5e1f06f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 91c5e1f06f

View security finding report

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.