[CI] Export immutable OCI index digest from release-image-cache-sync

[earayu]

Problem

.github/workflows/release-image-cache-sync.yml builds and pushes a multi-platform image but exposes only tag-name. Downstream workflows therefore cannot bind later copy or packaging work to the OCI index produced by that exact build step. Looking up a mutable tag after the build has a TOCTOU race, especially when concurrent runs publish latest.

Proposed change

Add one backward-compatible reusable-workflow output for the OCI index digest:

• give both conditional docker/build-push-action steps stable IDs;
• select exactly one non-empty steps.<build>.outputs.digest without querying a tag;
• require sha256:<64 lowercase hex> and fail when neither or both branches produce a digest;
• map the selected value through the job and workflow_call outputs;
• retain provenance: false and sbom: false on both build branches;
• add a static contract test covering both branches, XOR selection, output wiring, digest validation, and the absence of tag-query fallback.

Existing callers that only use tag-name remain unchanged.

Acceptance

• ARGS_TOKEN=true exports the digest from only the token build step.
• ARGS_TOKEN=false exports the digest from only the plain build step.
• Missing, duplicate, or malformed output fails the producer job.
• The reusable workflow exposes the validated digest as an additive output.
• Focused contract tests and repository checks pass.

This issue covers only the producer interface. Registry copy, offline packaging, artifact upload, release, and customer deployment stay outside this repository change.