feat: harden public Action and container distribution

[pixincreate]

Summary

• expose a checksum-verified root GitHub Action with an exact scanner version
• synchronize release preparation across Cargo, changelog, and Action metadata
• gate release artifacts and GHCR images with version checks, tests, container smoke coverage, and provenance
• document public GitHub Action and GHCR usage

Verification

• python3 scripts/action_validation/validate.py
• Python bytecode compilation for all validation modules
• bash -n scripts/release.sh
• YAML parsing for action.yml and changed workflows
• cargo fmt --all --check
• strict Clippy with warnings denied
• 147 debug tests
• 147 release tests
• cargo package --locked --allow-dirty
• local Docker build, version, non-root, and known-secret smoke checks
• D2 diagram drift check
• final read-only release/security audit: PASS