ci: publish OCI artifacts

[damacus]

Summary

Publish this cookbook's release artefacts as OCI images through the shared Sous Chefs release workflow.

• Update Sous Chefs shared workflow and action references to @main.
• Enable publish_oci: true.
• Grant the release workflow the required package and attestation permissions while preserving the existing release secrets.

Verification

• /opt/homebrew/bin/actionlint
• git diff --check

Risks / follow-ups

OCI publication runs only when the release workflow is triggered on main.

[github-actions]

Slowest examples

Top 7 slowest examples (0 seconds, 100% of total time)

Example	Description	Time in seconds
spec/libraries/helpers_spec.rb:22	Php::Cookbook::Helpers#php_version rhel is expected to eq "7.2"	0.00723
spec/libraries/helpers_spec.rb:62	Php::Cookbook::Helpers#php_version debian ubuntu 22.04 is expected to eq "8.1"	0.00051
spec/libraries/helpers_spec.rb:44	Php::Cookbook::Helpers#php_version debian debian 11 is expected to eq "7.4"	0.00047
spec/libraries/helpers_spec.rb:29	Php::Cookbook::Helpers#php_version amazon is expected to eq "8.2"	0.00043
spec/libraries/helpers_spec.rb:38	Php::Cookbook::Helpers#php_version debian debian 10 is expected to eq "7.3"	0.00042
spec/libraries/helpers_spec.rb:50	Php::Cookbook::Helpers#php_version debian ubuntu 18.04 is expected to eq "7.2"	0.0004
spec/libraries/helpers_spec.rb:56	Php::Cookbook::Helpers#php_version debian ubuntu 20.04 is expected to eq "7.4"	0.00035