Don't push attestations to the container registry

[timschumi]

While cool, those will spam the tag listing with unreadable and empty sha256 tags.

(This is a re-push of #3267 because GitHub apparently broke my PR.)

[greptile-apps]

Greptile Summary

This PR stops publishing build provenance attestations as OCI artifacts to the container registry while retaining GitHub-hosted attestations.

• Removes the explicit push-to-registry: true input from the Docker workflow’s provenance step.
• Leaves image publication, attestation generation, and required permissions unchanged.

Confidence Score: 5/5

The PR appears safe to merge because it disables only registry publication of attestations and preserves provenance generation.

The attestation action defaults registry publication to disabled, while the workflow retains the subject metadata, push-event guard, and permissions required to store attestations in GitHub.

Important Files Changed

Filename	Overview
.github/workflows/ci-docker.yml	Removes registry publication of provenance attestations; the action’s default preserves attestation generation and GitHub storage.

_{Reviews (1): Last reviewed commit: "Don't push attestations to the container..." | Re-trigger Greptile}