ci: publish OCI artifacts

[damacus]

Summary

Publish this cookbook's release artefacts as OCI images through the shared Sous Chefs release workflow.

• Update Sous Chefs shared workflow and action references to @main.
• Enable publish_oci: true.
• Grant the release workflow the required package and attestation permissions while preserving the existing release secrets.

Verification

• /opt/homebrew/bin/actionlint
• git diff --check

Risks / follow-ups

OCI publication runs only when the release workflow is triggered on main.

[github-actions]

Slowest examples

Top 10 slowest examples (0.46 seconds, 92.71% of total time)

Example	Description	Time in seconds
spec/unit/resources/client_spec.rb:29	git_client from source on ubuntu is expected to install package "["libcurl4-gnutls-dev", "libexpat1-dev", "gettext", "libz-dev", "libssl-dev"]"	0.08789
spec/unit/resources/client_spec.rb:15	git_client on ubuntu is expected to install package "default :install git"	0.05543
spec/unit/resources/client_spec.rb:30	git_client from source on ubuntu is expected to install_with_make ark "git"	0.04755
spec/unit/resources/client_spec.rb:28	git_client from source on ubuntu is expected to install build_essential "install compilation tools for git"	0.04595
spec/unit/resources/config_spec.rb:23	git_config set a global value is expected to run execute "git config --global user.name "Jane Doe""	0.04511
spec/unit/resources/client_spec.rb:40	git_client on macos is expected to install package "default :install git"	0.04215
spec/unit/resources/config_spec.rb:51	git_config set a file-scoped value with a home-relative config path is expected to run execute "git config --file "/root/.gitconfig.key" user.signingkey "FA2D8E280A6DD5""	0.03989
spec/unit/resources/config_spec.rb:34	git_config unset a system value is expected to run execute "git config --system --unset-all user.name"	0.03965
spec/unit/resources/client_spec.rb:65	git_client remove on ubuntu is expected to remove package "default :remove git"	0.03459
spec/unit/resources/client_spec.rb:52	git_client on windows is expected to install windows_package "Git version 2.54.0"	0.03113