fix(ci): preserve RC publish tag across release artifacts

[c-vigo]

Summary

• Use publish_version (not base version) for build, test, and artifact naming in release candidate/final release image flow.
• Align downloaded artifact patterns and source image tags in publish step to the same publish_version value.
• Prevent RC smoke-test deploys from falling back to stable-only tags when validating container image availability.

Test plan

• Pre-commit hooks pass for the workflow change.
• Run release workflow in candidate mode for 0.3.0 and verify generated smoke-test PR writes .vig-os with DEVCONTAINER_VERSION=<rc tag>.
• Verify smoke-test CI (Container) resolves and validates ghcr.io/vig-os/devcontainer:<rc tag> successfully.
• Run final release workflow and verify stable release path remains unchanged.

Refs: #296

[Copilot]

Pull request overview

Updates the release workflow to consistently propagate publish_version (including -rcN suffix for candidate releases) through image build/test, artifact naming, and publish steps so downstream smoke-test deploys validate the exact RC tag that was published.

Changes:

• Build and test images using needs.validate.outputs.publish_version instead of the base version.
• Rename and align container image artifact names/patterns to publish_version for upload/download.
• Align publish-step source image tags to publish_version to avoid stable-tag fallbacks during RC publishing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.