ci: clear zizmor findings on image-publish.yml

Pedantic-persona zizmor (the form CI runs under
``--persona pedantic --format github``) was failing with two findings
on the image-publish workflow:

* ``cache-poisoning`` (high) — ``astral-sh/setup-uv`` enables its cache
  by default. In a workflow that pushes signed artifacts to GHCR, a
  poisoned cache could influence the publishing step. Set
  ``enable-cache: false`` on this workflow's setup-uv invocation; the
  other setup-uv calls (lint, tests, env-examples, security, etc.)
  aren't publishing workflows and keep caching for speed.
* ``undocumented-permissions`` (low) — ``packages: write`` at job
  level had no explanatory comment. Added the same style of inline
  comment release-images.yml already uses
  (`docker/login-action + build-push-action push to GHCR`).

``zizmor --persona pedantic --format github`` exits 0 after the fix.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Zhengyuan Su <su.zhengyuan@u.nus.edu>

Author: timzsu

.github/workflows/image-publish.yml

@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: write
+      packages: write  # docker/login-action + build-push-action push to GHCR
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
@@ -78,6 +78,8 @@ jobs:
         with:
           version: "0.11.8"
           python-version: "3.12"
+          # No uv cache restore in a publishing workflow (cache-poisoning).
+          enable-cache: false
 
       - name: Sync server requirements from uv.lock
         run: uv run --frozen scripts/dev/sync_requirements.py --write