[v2.3][CI] Stabilize supply-chain triggers + action versions

[JasonEran]

Scope

Stabilize v2.3 CI/supply-chain workflows for Epic #14.

Closes #46
Closes #47

Changes

• Add path-filtered push/pull_request triggers to:
  • .github/workflows/supply-chain.yml
  • .github/workflows/slsa-source-provenance.yml
• Keep workflow_dispatch for manual release builds.
• Refresh supply-chain action versions:
  • docker/build-push-action@v6
  • anchore/sbom-action@v0.22.2
  • sigstore/cosign-installer@v4
• Add stabilization notes: docs/CI-SupplyChain-Stabilization-v2.3.md
• Update README/changelog/release-notes references.

Validation

• Local workflow checks (YAML + trigger/action assertions) passed.
• Manual dispatch verification on branch feature/v2.3:
  • Supply Chain: https://github.com/JasonEran/Aether-Guard/actions/runs/22387405901 (success)
  • SLSA Source Provenance: https://github.com/JasonEran/Aether-Guard/actions/runs/22387406761 (success)

Acceptance Mapping

• [CI] Restrict workflow triggers (paths filters + workflow_dispatch) #46
  • paths filters applied: ?
  • workflow_dispatch retained: ?
• [CI] Fix supply-chain workflows (SLSA/SBOM/Syft permissions) #47
  • SLSA permissions path preserved and run succeeds: ?
  • SBOM generation succeeds (run evidence above): ?
  • no deprecated action references in supply-chain workflow: ?