ci: replace BuildKit attestations with proper signed provenance

[YagUber]

The GHCR container page currently shows unknown/unknown entries alongside linux/amd64 and linux/arm64. This is caused by BuildKit automatically embedding attestation metadata directly into the image manifest, which GHCR displays as an extra platform entry.

Inspecting the manifest confirms these are BuildKit embedded attestations, each has a vnd.docker.reference.type: attestation-manifest annotation referencing its respective platform image:

$ docker buildx imagetools inspect ghcr.io/pnrxa/openposterdb:latest

Manifests: 
  Name:        ghcr.io/pnrxa/openposterdb:latest@sha256:f9ffa3a13919dcba90a3e1edc3df3ebfcc8ebb16bacb4fab6d6e4ef658fe5f2d
  MediaType:   application/vnd.oci.image.manifest.v1+json
  Platform:    linux/amd64
               
  Name:        ghcr.io/pnrxa/openposterdb:latest@sha256:ce0ddfe5c1bb96099f77f87f786c69595f6f36194efa0dee66c202f140507645
  MediaType:   application/vnd.oci.image.manifest.v1+json
  Platform:    unknown/unknown
  Annotations: 
    vnd.docker.reference.digest: sha256:f9ffa3a13919dcba90a3e1edc3df3ebfcc8ebb16bacb4fab6d6e4ef658fe5f2d
    vnd.docker.reference.type:   attestation-manifest
               
  Name:        ghcr.io/pnrxa/openposterdb:latest@sha256:6a779932e07bf430d21fe8f78268c4465a8168995331f4033f4f7b3b15771318
  MediaType:   application/vnd.oci.image.manifest.v1+json
  Platform:    linux/arm64
               
  Name:        ghcr.io/pnrxa/openposterdb:latest@sha256:503461cba08afa6a46a51aa9ff98c6b229fad1396412e16810daf094f8e2cf83
  MediaType:   application/vnd.oci.image.manifest.v1+json
  Platform:    unknown/unknown
  Annotations: 
    vnd.docker.reference.digest: sha256:6a779932e07bf430d21fe8f78268c4465a8168995331f4033f4f7b3b15771318
    vnd.docker.reference.type:   attestation-manifest

---

This PR fixes that by:

• Adding provenance: false to the build step to disable BuildKit's automatic attestation embedding
• Capturing the merged manifest digest from each imagetools create call
• Attaching proper signed provenance attestations to both the GHCR and Docker Hub images using actions/attest via Sigstore/OIDC