Fix sign job failure in container publish workflow by handling multiline tag outputs safely

[Copilot]

The Build and Sign Container Image workflow was failing in the sign job because ${{ needs.build.outputs.tags }} is multiline and was expanded directly in a shell for loop, producing invalid bash syntax. This PR updates tag consumption and related signing/provenance logic to be robust for multi-tag releases.

• Root cause addressed

  • Replaced direct interpolation loops like for tag in ${{ needs.build.outputs.tags }} with line-safe iteration over an env-provided multiline string.

• Workflow loop hardening (sign, provenance, verify)

  • Added TAGS env wiring from needs.build.outputs.tags.
  • Iterates with printf '%s\n' "$TAGS" | while IFS= read -r tag; do ...; done.
  • Skips empty lines defensively.

• Shell interpolation safety + output cleanup

  • Moved GitHub expression values used in shell (ref_name, ref_type, repo/ref) into step env variables before command use.
  • Removed redundant nested redirection when writing version to $GITHUB_OUTPUT.

• Supply-chain verification/provenance tightening

  • cosign verify now pins certificate identity to this exact workflow and ref.
  • SLSA buildType now includes workflow ref (@${GITHUB_REF}) for versioned provenance identity.

env:
  TAGS: ${{ needs.build.outputs.tags }}
run: |
  printf '%s\n' "$TAGS" | while IFS= read -r tag; do
    [ -n "$tag" ] || continue
    cosign sign --yes --recursive "$tag"
  done