[patch] Harden verified image publication

[libops-agent]

Summary

• build and scan native amd64/arm64 images on pull requests without publisher credentials
• publish signed GHCR manifests only through the SHA-pinned shared workflow after tested main or tag pushes
• replace the moving LibOps build image, run as an unprivileged UID, and enforce the workflow/image contract in Go tests

Validation

• go test -race -count=1 -timeout=2m ./...
• actionlint .github/workflows/lint-test-build.yml
• go mod tidy -diff
• git diff --check