STAC-24960 fix immutable image tag check

[LouisLotter]

Fixes the publish actions so immutable tag enforcement is based on the final release tag in the target registry, not only Docker/buildx resolver state for per-architecture staging tags.\n\nChanges:\n- Add a shared registry tag helper that checks the target registry with docker manifest inspect.\n- Keep docker buildx imagetools inspect as advisory resolver state and warn if it disagrees with the registry check.\n- Allow existing per-architecture staging tags to be overwritten when the final release tag is absent, so partial publishes can be completed.\n- Repeat the final release-tag guard in merge-multiarch before creating the multiarch manifest.\n- Add mocked unit coverage for existing final tags, missing final tags, stale resolver state, existing staging tags, and unknown registry state.\n- Trigger workflow/action security audit for .github/actions changes and add a focused publish-action unit test workflow.\n\nValidation:\n- bash -n .github/actions/shared/registry-tag-check.sh .github/actions/shared/registry-tag-check.test.sh\n- bash .github/actions/shared/registry-tag-check.test.sh\n- shellcheck .github/actions/shared/registry-tag-check.sh .github/actions/shared/registry-tag-check.test.sh\n- ruby YAML parse for action/workflow YAML\n- live Quay helper smoke check: existing final tag blocks, missing final tag with existing arch staging tag warns and allows\n- go test ./... in evaluator\n- go vet ./... in evaluator\n- uvx zizmor --collect=workflows,actions,dependabot .