ci: GHCR commit-SHA tag, OCI labels, and build provenance (#3528) #3061

Job	Run time
typecheck / typecheck	6m 32s
units / packages / 🧪 Unit Tests: Packages (1, 1)	8m 37s
units / e2e-webapp / 🧪 E2E Tests: Webapp	3m 48s
units / internal / 🧪 Unit Tests: Internal (2, 8)	12m 31s
units / internal / 🧪 Unit Tests: Internal (5, 8)	6m 2s
units / internal / 🧪 Unit Tests: Internal (6, 8)	7m 47s
units / internal / 🧪 Unit Tests: Internal (3, 8)	8m 30s
units / internal / 🧪 Unit Tests: Internal (4, 8)	6m 11s
units / internal / 🧪 Unit Tests: Internal (7, 8)	5m 41s
units / webapp / 🧪 Unit Tests: Webapp (7, 8)	6m 27s
units / webapp / 🧪 Unit Tests: Webapp (1, 8)	6m 4s
units / webapp / 🧪 Unit Tests: Webapp (6, 8)	4m 5s
units / webapp / 🧪 Unit Tests: Webapp (5, 8)	9m 11s
units / internal / 🧪 Unit Tests: Internal (1, 8)	6m 59s
units / webapp / 🧪 Unit Tests: Webapp (4, 8)	6m 3s
units / internal / 🧪 Unit Tests: Internal (8, 8)	2m 39s
units / webapp / 🧪 Unit Tests: Webapp (3, 8)	3m 58s
units / webapp / 🧪 Unit Tests: Webapp (2, 8)	4m 7s
units / webapp / 🧪 Unit Tests: Webapp (8, 8)	2m 30s
publish-webapp / publish	6m 45s
publish-worker-v4 / build (supervisor)	1m 41s
publish-worker / build (coordinator)	1m 41s
publish-worker / build (kubernetes-provider)	57s
publish-worker / build (docker-provider)	2m 9s
units / packages / 📊 Merge Reports	22s
units / webapp / 📊 Merge Reports	49s
units / internal / 📊 Merge Reports	23s
	2h 12m 29s

Provide feedback