[patch] Align publisher with applied identity

[libops-agent]

Summary

• pin the signed dual-registry image publisher to the immutable shared-workflow revision already authorized by the applied WIF provider
• keep the certificate identity and publication contract tests aligned
• retain newer revisions for unrelated shared workflow callers

Validation

• focused publication contract tests
• actionlint
• git diff --check