fix(build-image): tag ECR runtime manifests as latest

[gersmann]

Summary

• Fix latest tagging in the reusable Docker Bake build path. Inspector scans the runtime image manifest, while BuildKit's provenance places tags on a parent OCI index.
• Resolve each target's immutable build digest from Bake metadata and point latest directly at its sole runtime manifest using imagetools create --prefer-index=false.
• Keep version/SHA tags on the original indexes, preserving their attestations. Existing single-image and matrix build paths are unchanged.
• Reject multi-platform output instead of silently choosing an architecture. Add seven mocked publishing tests to PR checks.

Rollout

This takes effect on subsequent builds once consumers receive the updated reusable workflow. Existing ECR images are not retagged. Consumers needing provenance should use version/SHA references; latest now references the runtime manifest directly.

Validation

• node --test tests/build-image.test.cjs: 7 passed. Executes the workflow's actual Bash with mocked Docker/AWS, covering indexes with attestations, direct manifests, named targets, and rejection cases.
• npm run lint: passed.
• /home/gersmann/go/bin/actionlint (v1.6.23): passed.
• git diff --check: passed.
• Authenticated docker buildx imagetools create --dry-run --prefer-index=false against an existing ECR runtime digest produced a direct OCI image manifest. No registry writes, builds, or deployments were performed.
• Correctness and Ponytail reviews passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T11:40:13.039868Z	f42a2cc	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.