Fix Docker release publish failure on GHCR by disabling provenance output

[Copilot]

The Docker release workflow was failing at push time with a 400 Bad Request on manifest upload. The failure was caused by Buildx publishing provenance/attestation artifacts that the target publish path did not accept.

• Workflow change: Docker publish

  • Updated .github/workflows/docker-publish.yml in the docker/build-push-action@v6 step.
  • Explicitly disabled provenance generation for release image pushes.

• Why this matters

  • Keeps release tagging/push behavior unchanged.
  • Avoids emitting extra attestation/manifest index output that caused the registry-side reject.

- name: Build and push Docker image
  uses: docker/build-push-action@v6
  with:
    context: .
    push: true
    provenance: false
    tags: ${{ steps.meta.outputs.tags }}
    labels: ${{ steps.meta.outputs.labels }}

[amitsaha]

@copilot i don't understand this provenance issue, explain.