Fix prebuilt catalog promotion review

[joecklau]

Summary

• Fix protected prebuilt promotion failure caused by ORAS refusing an absolute catalog layer title.
• Fetch unsigned collision-check catalogs by validated OCI descriptor digest and publish future catalog layers with controlled relative titles.
• Add an unprotected Prepare protected promotion review job with verified candidate identities, four acceptance links, runner names, receipt hashes, and a reviewer checklist before environment approval.
• Keep the existing protected job fail-closed and repeat all machine-verifiable checks after approval.

The failure being corrected is https://github.com/solutionforest/ephemeral-action-runner/actions/runs/31424735575/job/93573635441. It occurred before acceptance or stable alias mutation.

Validation

• actionlint .github/workflows/docker-sandboxes-images.yml
• bash -n .github/scripts/fetch-prebuilt-catalog.sh
• go test ./internal/prebuilt ./cmd/epar-prebuilt-publisher -count=1
• go test -race ./internal/prebuilt ./cmd/epar-prebuilt-publisher -count=1
• go vet ./internal/prebuilt ./cmd/epar-prebuilt-publisher
• scripts/docker-sandboxes/validate-assets.ps1 -Platform linux/amd64
• scripts/docker-sandboxes/validate-assets.ps1 -Platform linux/arm64
• git diff --check

The full local go test ./... run passed the changed packages and encountered only the known host-environment global-lock and WSL Bash E_ACCESSDENIED fixture failures.

Checklist

• I kept credentials, private keys, tokens, and machine-specific configuration out of this pull request.
• I added or updated tests where behavior changed.
• I updated relevant documentation.
• For provider or onboarding changes, I followed the Development and Extension Principles and documented and tested every intentional exception.
• I read and followed the contributing guide and code of conduct.