ci: publish OCI artifacts

[damacus]

Summary

Publish this cookbook's release artefacts as OCI images through the shared Sous Chefs release workflow.

• Update Sous Chefs shared workflow and action references to @main.
• Enable publish_oci: true.
• Grant the release workflow the required package and attestation permissions while preserving the existing release secrets.

Verification

• /opt/homebrew/bin/actionlint
• git diff --check

Risks / follow-ups

OCI publication runs only when the release workflow is triggered on main.

[github-actions]

Slowest examples

Top 10 slowest examples (0.42 seconds, 42.82% of total time)

Example	Description	Time in seconds
spec/resources/jce_spec.rb:10	java_jce install downloads the JCE archive to the explicit download path	0.08518
spec/resources/alternatives_spec.rb:8	java_alternatives converges with an empty command list without shelling out	0.05921
spec/resources/temurin_package_install_spec.rb:12	temurin_package_install installs the Adoptium apt keyring	0.03623
spec/resources/temurin_package_install_spec.rb:25	temurin_package_install installs the Temurin package	0.03529
spec/resources/openjdk_source_install_spec.rb:70	openjdk_source_install custom source URL with explicit java_home uses the explicit java_home	0.03497
spec/resources/corretto_install_spec.rb:9	corretto_install downloads the Corretto archive	0.03479
spec/resources/temurin_package_install_spec.rb:42	temurin_package_install on Amazon Linux uses the Adoptium Amazon Linux 2 RPM repository	0.0347
spec/resources/openjdk_pkg_install_spec.rb:16	openjdk_pkg_install does not write node java_home state	0.03443
spec/resources/temurin_package_install_spec.rb:32	temurin_package_install on AlmaLinux uses the RHEL-compatible Adoptium RPM repository	0.03415
spec/resources/openjdk_source_install_spec.rb:46	openjdk_source_install custom source URL sets alternatives to the derived java_home	0.034