Emit verifiable OCI provenance from shared container build actions

[kushuh]

Goal

Make the shared Docker build actions emit verifiable OCI provenance for every pushed GHCR image so the public infra deployment can enforce source identity before promotion.

Scope

• Update both build-actions/docker and build-actions/docker-job after the successful push to invoke GitHub artifact attestation for ghcr.io/${image_name} and the exact build digest, with registry publication enabled.
• Preserve least job permissions: contents: read, packages: write, attestations: write, id-token: write; fail clearly when a caller omits them.
• Pin the external attestation action to a reviewed full commit SHA and let Renovate maintain the comment/tag metadata.
• Add tests/a release fixture that verifies gh attestation verify oci://… --repo <expected source repo> succeeds and rejects a different repository/digest.
• Document the supply-chain contract for consumers.

Rollout

1. Merge and release a-novel-kit/workflows.
2. Let Renovate repin service-json-keys and service-authentication to the released action version.
3. Cut fresh patch releases for both services so database, job, gRPC, and REST images all have attestations.
4. Only then enable the infra deployment's hard provenance gate.

Published tags are immutable. If an attestation is wrong or missing, release a fixed workflow and fresh service patch; never rewrite the old image tag.

Acceptance criteria

• Every image built through either shared action has a registry-visible provenance attestation bound to its digest and source repository.
• Verification works without granting the deployment workflow package write access to GHCR.
• No token, attestation payload, registry credential, or image metadata with secret values appears in logs.
• Existing callers without the required permissions fail before publishing an unattested release or receive an explicitly staged compatibility window documented in the PR.

Context

Cross-org prerequisite for the Google Cloud infrastructure Epic in a-novel/.github. The current callers grant attestation permissions, but the shared actions do not emit attestations.