[patch] Adopt resilient image publication

[libops-agent]

Summary

• pin image publication to the shared main-verification retry fix
• keep the status and release workflows on the same reviewed shared SHA
• update the immutable publication contract and signing identity

Verification

• go test -p=1 ./...
• actionlint
• git diff --check