[alexeybe1kin]

Queue Lane C item 4 (Release pages, SBOM, signed images).

• sbom: true on every image build: BuildKit attaches an SPDX SBOM to the image index. The existing attest-build-provenance step signs (Sigstore, keyless) the index digest, so it covers the SBOM too. No new action and no cosign key.
• A new release job, after the image jobs and only on a v* tag, with contents: write for that job alone. It creates the GitHub Release page, using the version's ## X.Y.Z CHANGELOG section as the notes. If the release already exists, it is left as it is, so a rerun or a workflow_dispatch from the tag is harmless.
• One CHANGELOG line under Unreleased, with the verify command.

Test plan

• The YAML parses. The jobs and needs are correct.
• The awk extraction gives the right section against the latest tag's CHANGELOG.
• Not exercised until the next tag: PR CI does not run the publish workflow. On the next release, check that the Release page appears and that gh attestation verify oci://IMAGE@DIGEST --owner Conker-AI passes.