fix: preserve GHCR auth for attestations

[kricha-lab-dev-worker]

Summary

• make the isolated GHCR config exactly $HOME/.docker so actions/attest can discover login credentials
• apply the same correction to bootstrap and stable OCI publication
• run explicit cleanup with always() and switch stable verification to a separate anonymous config
• structurally reject credential lifecycle regressions with comment-safe negative fixtures

Verification

• reproduced run 33559830573: build/push passed, attestation failed with No credentials found for registry ghcr.io
• bootstrap negative fixtures: 9/9 PASS
• stable release credential fixtures: 9/9 PASS
• OCI helpers: 16/16 PASS
• go test ./..., go vet ./..., go build ./...: PASS
• independent exact-tree review: PASS

Refs #43