Wire SLSA L3 generator provenance

[NWarila]

Summary

• adds the SLSA generator tag-integrity guard and gates publish/signing to push events on main and v* tags
• wires the trusted SLSA container generator reusable workflow with image/digest outputs from the existing publish path
• documents the exact two-command SLSA verification contract and removes the GitHub-native attestation verifier from the SLSA path

Validation

• python tools\verify.py ci
• C:\tmp\actionlint-1.7.7-step006\actionlint.exe
• npx markdownlint-cli2 "**/*.md"
• git diff --check