Stage ImageIndexObserved events from the build/app-image workflows

[toddysm]

Context

#216 (PR #219) added the ImageIndexObserved event kind + the stage-image-index-events composite action, and wired it into the acquire (_mirror-image) and catalog (_promote-from-quarantine, _promote-from-quarantine-sbom, _promote-override) workflows.

The build stage was intentionally left out for now: app images (build-cssc-dashboard and friends) currently have no referrers, so wiring capture there produces no immediately useful edges. But once app images are published as multi-arch indexes, we want the same index ↔ per-platform child modeling for them so build lineage and per-platform attestations connect correctly (same gap #216 closed for golden/base images).

Scope

• Add a Stage image index graph event step (uses: ./.github/actions/stage-image-index-events) to the build workflow(s) after the image is pushed, passing the built image ref/digest/tag, writing to the shared graph-events staging dir.
• Confirm the record-graph-events collector already covers the build workflow via its workflow_run triggers (it does today) — no collector change expected.
• Add/extend a test or example if the build path differs from the mirror/promote wiring.

Acceptance criteria

• Building a multi-arch app image stages one ImageIndexObserved event linking the index to its per-platform children.
• Single-arch builds stage nothing (no-op), matching the mirror/promote behaviour.
• No duplicate/erroneous events for attestation/attachment manifests.

Links

• Follow-up to Model the multi-arch index ↔ per-architecture child manifest relationship #216 (PR Model the multi-arch index ↔ per-architecture child manifest relationship #219)
• Related: Roll up per-platform attestations to the image in graph queries/views #217 (roll up per-platform attestations), Design: represent and present multi-arch (index) + per-architecture manifests in the graph #218 (multi-arch design)