feat: add attest-images action for container image build provenance attestation

[Copilot]

Adds a dedicated actions/docker/attest-images composite action for SLSA build provenance attestation using actions/attest (not actions/attest-build-provenance, which GitHub now deprecates for new implementations). Signing and attestation are distinct supply-chain controls — this keeps them properly separated.

New action: actions/docker/attest-images

• Accepts the same images input format as sign-images (registry/name:tag@digest, JSON array, or delimited string)
• Deduplicates by registry/name + digest — multiple tags sharing a digest produce one attestation
• Calls actions/attest@v4.1.1 (SHA-pinned) per unique subject; supports up to 5 unique images per invocation via static conditional steps (composite actions cannot dynamically loop over uses: steps)
• push-to-registry: true by default, storing the attestation as an OCI artifact alongside the image
• Required permissions: id-token: write, attestations: write

Updated: docker-build-images reusable workflow

Adds an attest boolean input (default false) that triggers attestation after manifest publication, mirroring the existing sign input pattern:

uses: hoverkraft-tech/ci-github-container/.github/workflows/docker-build-images.yml@main
with:
  sign: true    # cosign registry-native signature
  attest: true  # GitHub-native SLSA provenance attestation

The publish-manifests job gains attestations: write permission (only exercised when attest: true).

Signing vs. attestation

Control	Action	What it proves
Signature	sign-images (cosign)	Image was signed by a trusted identity — registry-native
Provenance	attest-images (this PR)	Image was built by a specific workflow on a specific commit — GitHub-native

Both should be used together for a complete supply-chain posture. Attestations can be verified with gh attestation verify oci://ghcr.io/….

[neilime]

@copilot add CI tests

[Copilot]

@copilot add CI tests

Added in commit fix: use if/else in attestation assertion step (and its predecessor).

Created .github/workflows/__test-workflow-docker-build-images-attestation.yml following the arrange/act/assert/cleanup pattern used by existing test workflows:

• Arrange — generates a matrix of 3 cases: mono-arch attested, multi-arch attested, and mono-arch not-attested
• Act — calls docker-build-images.yml with attest: ${{ matrix.attest }} and sign: false
• Assert — runs gh attestation verify oci://ghcr.io/… to confirm attested images have provenance and non-attested images do not
• Cleanup — deletes ephemeral test packages

Also registered the new test in __shared-ci.yml (with attestations: write) and propagated attestations: write to the CI caller workflows (__pull-request-ci.yml, __main-ci.yml).