ci: fix release provenance subject

[pheidon]

Summary

• emit a separate untagged image repository output from release metadata
• use that repository name as the SLSA provenance subject while keeping tagged refs for build and runtime checks
• cover the provenance subject wiring in the release workflow test

Validation

• corepack pnpm vitest run test/release-workflow.test.ts
• corepack pnpm test
• corepack pnpm build

Context

The v0.2.1 release image workflow builds and pushes successfully, but actions/attest-build-provenance@v3 rejects tagged image refs as subject-name with Invalid image name: ghcr.io/omt-global/github-runner-fleet:0.2.1. This keeps the final release verification from completing even though the image itself contains GitHub Actions runner 2.334.0.