feat: publish Gate as an OCI image

[kricha-lab-dev-worker]

Summary

• publish the Gate as a hardened multi-architecture OCI image on GHCR
• add authenticated immutable-tag preflight and digest-bound release verification
• require exact amd64/arm64 runtime descriptors with BuildKit SBOM/provenance attestations
• document first-package bootstrap and anonymous-pull verification

Verification

• OCI helper self-tests: 16/16 PASS
• OCI static contract: PASS
• rootless container E2E: PASS
• BuildKit attestation descriptor probe: PASS
• release publication E2E: 9/9 PASS
• go test ./... and go test -race ./...: PASS
• go vet ./... and go build ./...: PASS
• independent exact-tree review: PASS

Refs #43