UID2-7041: promote OCI tag only after attest+verify pass

[BehnamMozafari]

Summary

• Push image by digest only (no consumable tag) in both docker publish flows; after actions/attest_image@v3 (SLSA attest + gh attestation verify) succeeds, run docker buildx imagetools create to promote the digest to the consumable tag (1.2.3, latest). Closes the gap from PR UID2-6764: Add SLSA build provenance attestations to docker publish workflows #228 (UID2-6764) where the consumable tag escaped the policy gate if attest/verify failed.
• Applied identically to the composite (actions/shared_publish_to_docker/action.yaml) and the inline Java workflow (.github/workflows/shared-publish-java-to-docker-versioned.yaml).
• Fail-fast on the new promote step (no retry) — matches the existing push step's policy. On a promote failure the verified digest persists in the registry; the previous tag still resolves; the next release re-runs the full flow.

How the three paths route

Path	Attest step	Promote step (default if: success())	Tag created?
Release (not_snapshot=true, attestation_enabled=true)	runs	runs (after pass)	✅
Release + attest/verify fails	runs and fails	skipped	❌ (stays at previous good)
Snapshot (not_snapshot=false)	skipped	runs	✅
Opt-out (attestation_enabled=false)	skipped	runs	✅

Skipped steps count as success for downstream if: success(), so the same promote step services all three "should-tag" paths without no explicit condition.

Smoke evidence

Throwaway smoke harness (deleted in this PR's history) exercised both paths inline against this branch's code (local action refs, not @v3):

• Green path — run 25783580596: push-by-digest → pre-promote tag absence asserted → attest+verify → promote → gh attestation verify against the consumable tag passes.
• Forced-failure path — run 25783628840: push-by-digest → attest+verify → injected failure → promote step skipped → no consumable tag created. Proves the if: success() gate holds.

Out of scope / follow-up

• @v3 promotion: after merge, move @v3 forward via update-major-version-tags.

Test plan

• Smoke green path
• Smoke forced-failure path
• After merge: update-major-version-tags moves @v3 to this SHA
• Spot-check 2-3 consumer releases use the new flow without caller-side changes

🤖 Generated with Claude Code