feat: export immutable release image digest

[earayu]

Closes #786

What changed

• expose the successful docker/build-push-action digest as an additive reusable-workflow output;
• fail closed unless exactly one conditional build branch returns a lowercase sha256:<64hex> digest;
• retain the existing no-provenance/no-SBOM contract on both build branches;
• add a focused executable contract and path-scoped CI workflow.

Why

Downstream callers currently receive only the mutable image tag. Concurrent runs that publish the same tag can therefore bind later copy or packaging work to another run's image. The build action output is the only receipt naturally tied to the exact successful build.

Existing callers that use only tag-name are unchanged. Callers that consume the new output must still validate the referenced media type and platform graph for their own requirements.

Validation

• python3 .github/utils/test_release_image_cache_sync_contract.py (6 tests)
• uvx ruff==0.11.13 check .github/utils/test_release_image_cache_sync_contract.py
• uvx ruff==0.11.13 format --check .github/utils/test_release_image_cache_sync_contract.py
• both workflow files parsed with PyYAML 6.0.2
• git diff --check

This PR does not invoke the reusable workflow, build or publish an image, or write to any registry/artifact/OSS/customer environment.

[earayu]

@JashBook @dengkailu Could one of you please review and merge this exact head e74b3e4d65373b97f011fb4076e78042b61dc347?

The PR is ready and MERGEABLE; the contract check succeeded. Independent CR1/CR2 are complete in the delivery review record. The current author identity cannot satisfy the required non-author approval or protected merge policy, and @earayu has explicitly requested merge. Please use a normal protected approval + merge; no admin bypass.