Publish Quovy-maintained hardened sandbox images

[prazgaitis]

Summary

This establishes Quovy's maintained OpenSandbox baseline while the focused fixes are reviewed upstream:

• preserve non-root and container security settings in Kubernetes sandbox templates;
• harden the egress image and refresh its dependencies;
• make pause/snapshot/resume reliable when containerd has garbage-collected compressed source layers;
• publish linux/amd64 and linux/arm64 images to GHCR with BuildKit provenance and SBOM attestations;
• scan both platforms, block any Critical finding, retain full High/Critical evidence, and keyless-sign the exact digest with GitHub OIDC.

The code changes remain split into upstream PRs opensandbox-group#1506, opensandbox-group#1507, and opensandbox-group#1508 so this branch can be reduced as each fix lands upstream.

Validation

• Server: 180 focused tests, Ruff, Pyright, native arm64 image build and CLI smoke.
• Egress: Go tests, 54 mitmproxy tests, live DNS/nftables smokes, native arm64 build, Trivy 0 Critical.
• Image committer: Go tests, native arm64 build, Trivy 0 Critical, and a real k3d pause/push/resume test after deliberately removing a source blob; filesystem state and the non-root security context survived.
• Workflow YAML parses locally; all third-party actions are pinned by commit.

The signed images are candidates, not automatic customer promotion. Quovy's BYOC release inventory will pin the resulting immutable digests after the workflow completes.