ci: publish OCI artifacts

[damacus]

Summary

Publish this cookbook's release artefacts as OCI images through the shared Sous Chefs release workflow.

• Update Sous Chefs shared workflow and action references to @main.
• Enable publish_oci: true.
• Grant the release workflow the required package and attestation permissions while preserving the existing release secrets.

Verification

• /opt/homebrew/bin/actionlint
• git diff --check

Risks / follow-ups

OCI publication runs only when the release workflow is triggered on main.

[github-actions]

Slowest examples

Top 10 slowest examples (1.3 seconds, 34.33% of total time)

Example	Description	Time in seconds
spec/unit/library/helper_spec.rb:18	helper methods npm_dist should return a url based on the version	0.20998
spec/unit/resources/nodejs_repository_spec.rb:16	nodejs_repository on ubuntu is expected to create directory "/etc/apt/keyrings"	0.20048
spec/unit/resources/nodejs_install_spec.rb:33	nodejs_install package install on rocky linux is expected to disable dnf_module "nodejs"	0.16146
spec/unit/resources/nodejs_install_spec.rb:15	nodejs_install package install on ubuntu is expected to create nodejs_repository "nodesource"	0.14078
spec/unit/resources/nodejs_repository_spec.rb:42	nodejs_repository remove on ubuntu is expected to delete file "/etc/apt/keyrings/nodesource.asc"	0.10307
spec/unit/resources/nodejs_install_spec.rb:89	nodejs_install source install is expected to create link "/usr/local/bin/python"	0.10001
spec/unit/resources/nodejs_install_spec.rb:86	nodejs_install source install is expected to install build_essential "install build tools"	0.09824
spec/unit/resources/nodejs_install_spec.rb:34	nodejs_install package install on rocky linux is expected to install package "nodejs"	0.09731
spec/unit/resources/nodejs_install_spec.rb:16	nodejs_install package install on ubuntu is expected to install package "nodejs"	0.09726
spec/unit/resources/nodejs_repository_spec.rb:19	nodejs_repository on ubuntu is expected to add apt_repository "nodesource"	0.09659