Publish signed image provenance manifests

[msarahan]

The purpose of this PR is to surface image contents in better ways. As part of our release process, the images that this repo produces get scanned with various tools to find CVEs and malware. These tools are prone to misidentifying some components, and that has been especially true for conda packages historically. We have frequently needed to override the detected package lists/SBOM via JIRA tickets with our security tools team. Part of filing those tickets is providing them with the actual contents of the images, which we often have to discover by looking into build logs.

That's where this PR comes in. Instead of looking at build logs, we should export our known environment information to a more readily usable location. In theory, this could replace the scans, but I think it's better to keep doing the scans and use our manifests as validation/correction where necessary. That keeps us in line with how security tools team manages other projects.

Posted by Codex (GPT-5.6) on behalf of Michael Sarahan. Treat this PR description as LLM-generated.

Summary

Reintroduce the signed image provenance work from commit f33fc76482b53c2f278da1a4e16bb8a1861bab7a as one commit on main, after it was reverted from release/26.08 in #903.

• Export exact conda and pip package facts through minimal BuildKit targets.
• Attach platform-specific provenance manifests and multiarch provenance indexes as OCI referrers.
• Sign attached artifacts keylessly with GitHub Actions OIDC and Cosign.
• Carry immutable image, source, workflow, build-argument, and platform relationships without pulling final image layers.
• Keep conda pURLs explicitly unmapped until a verified upstream mapping exists.
• Use main notebook inputs for main builds and matching release/YY.MM inputs for release-targeted builds, including alpha-tagged builds.