ci: publish OCI artifacts

[damacus]

Summary

Publish this cookbook's release artefacts as OCI images through the shared Sous Chefs release workflow.

• Update Sous Chefs shared workflow and action references to @main.
• Enable publish_oci: true.
• Grant the release workflow the required package and attestation permissions while preserving the existing release secrets.

Verification

• /opt/homebrew/bin/actionlint
• git diff --check

Risks / follow-ups

OCI publication runs only when the release workflow is triggered on main.

[github-actions]

Slowest examples

Top 10 slowest examples (1.08 seconds, 45.7% of total time)

Example	Description	Time in seconds
spec/unit/resources/powershell_wmf_spec.rb:98	powershell_wmf when requesting a delayed reboot with an explicit delay is expected to eq 5	0.15154
spec/unit/resources/powershell_wmf_spec.rb:52	powershell_wmf when installing PowerShell 4.0 with an invalid .NET requirement raises an error	0.14781
spec/unit/resources/powershell_dsc_spec.rb:17	powershell_dsc is expected to install powershell_wmf "4.0"	0.12266
spec/unit/resources/powershell_wmf_spec.rb:78	powershell_wmf when installing PowerShell 5.1 on Windows Server 2008 R2 is expected to equal true	0.10273
spec/unit/resources/powershell_winrm_spec.rb:19	powershell_winrm with default properties is expected to run powershell_script "enable winrm"	0.09621
spec/unit/resources/powershell_lcm_spec.rb:27	powershell_lcm with action :enable is expected to create directory "Creating temporary directory to store LCM MOF files"	0.09352
spec/unit/resources/powershell_wmf_spec.rb:33	powershell_wmf when installing PowerShell 3.0 on Windows Server 2008 R2 is expected to install windows_package "Windows Management Framework Core 3.0"	0.09342
spec/unit/resources/powershell_wmf_spec.rb:65	powershell_wmf when installing PowerShell 5.1 on Windows Server 2008 R2 is expected to include recipe "ms_dotnet::ms_dotnet4"	0.09247
spec/unit/resources/powershell_wmf_spec.rb:114	powershell_wmf when using the legacy reboot timeout override is expected to eq 2	0.09175
spec/unit/resources/powershell_lcm_spec.rb:44	powershell_lcm with action :disable is expected to run powershell_script "Disable LCM"	0.09119