ci: add a least-privilege release workflow and tag validation

[joey-huckabee]

First of Package 4's three items.

The workflow cannot fire by accident

Trigger is a pushed tag only — no branch trigger, no schedule, no manual
dispatch. A release is caused by creating an immutable tag and by nothing
else.

Permissions are read-only at the workflow level and widened per job:

Job	Adds
validate tag	nothing — stays read-only
build	packages: write, id-token: write
publish manifest	contents: write, attestations: write

Before anything is built, the tagged commit must be an ancestor of main,
so a tag pointing at an unreviewed commit cannot publish it.

Tag validation is a tested script, not a regex in YAML

A release tag is immutable: one discovered to be wrong afterwards cannot be
corrected, only superseded. So the checks run before anything is published
under it, and they are covered by 15 unit tests in the lint job — exercised on
every change rather than once, during a release, when it is too late.

Beyond the pattern:

• the date is a real calendar date — 20260230 matches the pattern and is
  not a date
• the date is not in the future relative to UTC
• NGINX version and UBI major agree with the artifact lock, and the two
  architecture locks must agree with each other
• the tag is not already published
• the daily sequence continues from the highest used, so a gap left by a
  withdrawn release is never back-filled and two artifacts can never share a
  name

Digest-bound, and it verifies itself

Signature, provenance attestation, and SBOM attestation all bind to the
manifest digest, never to a tag — a tag can be made to point elsewhere, a
digest cannot. The workflow then runs cosign verify against its own signature
before publishing evidence, proving the signature is discoverable and bound to
this workflow's identity, which is what a consumer will actually check.

Two high-severity findings, fixed before commit

zizmor flagged ${{ github.actor }} expanding directly into a shell command
in both registry logins — template injection. Both values now travel as
environment variables, and the token is piped rather than placed in a
here-string. The workflow audits clean.

What this PR does not claim

The workflow has never been executed. That is stated in the file's own
header, not just here. Rehearsing it end to end from an untagged candidate is a
separate Package 7 item, and until that happens its behaviour is asserted by
reading rather than by evidence.

🤖 Generated with Claude Code