fix: harden release notes output and delivery

[mwaldheim]

Summary

• build each OCI platform once, scan the exported layout, and promote only verified digests
• fail closed on ambiguous registry resolution and reconcile mutable tags from strict SemVer releases
• pin workflow dependencies while preserving current-main and plugin semantic fixes

Validation

• go mod verify
• go test ./...
• golangci-lint config verify -c .golangci.yml
• golangci-lint run
• go build ./cmd/plugin
• actionlint
• target-scoped release verifier, including upstream resolution of 22 exact action pins

Caveats

• Docker/OCI runtime validation remains for Linux CI because Docker is unavailable locally.
• The 42-repository workspace equality check currently sees two release-workflow variants because out-of-scope repositories retain the prior setup-go pin; all 17 Docker repositories in this requested batch are byte-identical.
• This change hardens readiness controls; it does not claim the plugin is production-ready.