Promote prebuilt catalog promotion fix to main

[joecklau]

Summary

Promote the tested prebuilt catalog-promotion fix from develop to main.

This brings the following into the default-branch workflow before retrying the accepted Act candidate promotion:

• descriptor-addressed catalog retrieval that does not trust OCI layer paths;
• controlled relative titles for newly published catalog layers;
• an unprotected Prepare protected promotion review job with candidate identities, acceptance links, runner names, receipt hashes, and a reviewer checklist;
• repeated fail-closed verification inside the protected promotion job after approval.

Validation

PR #23 passed all checks before merging to develop, including the prebuilt publication contract, race/vet, Windows/macOS/Linux native read-only jobs, CGO-free builds, Docker trust rotation, and core canaries.

Checklist

• No controller release, Git tag, or GitHub Release is created by this PR.
• No stable GHCR alias is moved by pull-request validation.
• The exact accepted candidate remains immutable and requires a separate protected workflow dispatch after this PR merges.