feat: support build attestations and manifest verification

[l-you]

Summary

• add optional provenance and SBOM settings
• verify every requested platform in every published image tag
• expose the published image digest
• pin all executable action dependencies to full commit SHAs
• add fast, hermetic contract and behavior tests with visible output

Defaults

This is backward compatible for the moving v1 tag:

• provenance: '' — use docker/build-push-action's repository-aware default
• sbom: false
• verify-manifest: false

Consumers that want the complete release checks can explicitly set:

provenance: mode=max
sbom: true
verify-manifest: true

Max-mode provenance can publish build argument values. Secrets must use BuildKit secret mounts, not build-args.

Validation

• shell syntax check
• custom action metadata/default/output contract
• full-SHA dependency pin check
• positive verification for two tags and two platforms
• missing-platform, empty-tag, and unsafe-platform rejection

Green run: https://github.com/RevoTale/docker-multi-arch-release-action/actions/runs/33505430722