Harden prebuilt image publication hygiene

[joecklau]

Summary

• Publish Docker Sandboxes package candidates only from main, while pull requests run read-only publisher and asset validation.
• Assemble the final multi-platform image from exact platform digests and require exactly two descriptors.
• Keep signed index-level SLSA/SPDX and catalog evidence while removing redundant BuildKit per-platform attestation wrappers.
• Document the GHCR version graph, retention boundaries, and automatic image provisioning through ./start.

Validation

• go test ./internal/prebuilt ./cmd/epar-prebuilt-publisher -count=1
• go test -race ./internal/prebuilt ./cmd/epar-prebuilt-publisher -count=1
• go test ./... -run '^$' -count=1
• scripts/docker-sandboxes/validate-assets.ps1 -Platform linux/amd64
• scripts/docker-sandboxes/validate-assets.ps1 -Platform linux/arm64
• actionlint .github/workflows/docker-sandboxes-images.yml
• git diff --check

Checklist

• I kept credentials, private keys, tokens, and machine-specific configuration out of this pull request.
• I added or updated tests where behavior changed.
• I updated relevant documentation.
• For provider or onboarding changes, I followed the Development and Extension Principles and documented and tested every intentional exception.
• I read and followed the contributing guide and code of conduct.