ci: publish secure multiarch releases

[castrojo]

Summary

• run the full FSDK appliance gate on native amd64 and arm64 pull-request runners without registry credentials
• make VERSION canonical and require a matching v<VERSION> tag before publication
• publish an immutable annotated GHCR index with no mutable channel aliases
• attach dual-platform SPDX SBOMs, keyless-sign the image and SBOM, publish GitHub provenance, and verify all evidence

Verification

• just verify
• actionlint .github/workflows/*.yml
• bash -n tests/*.sh files/*.sh
• canonical VERSION/binary/OCI-label equality check
• local Podman release-label mutation smoke
• git diff --check

The tag-only publish path was reviewed and linted but intentionally not executed; it writes a real immutable release.

Stacked on #6 (feat/fsdk-appliance-parity).