fix(sign-image): login to ecr public before signing so cosign can push the signature

[null-paorodrigues]

Summary

• Adds Login to Amazon ECR Public step inside the composite action, between Configure AWS credentials and Install cosign
• cosign stores signatures as OCI artifacts in the same ECR repo — without an explicit ECR Public login, the push fails with 401 Unauthorized
• Consistent with the existing design decision of keeping all auth setup (including configure-aws-credentials) inside the action so callers don't need to manage prerequisites

Root cause

Sign jobs in k8s-tools run on a fresh runner separate from the build job. The ECR login done during the build is not available in the sign job. The composite action needs to handle its own ECR auth.