[gonzaloaune]

I added source/revision labels and build-provenance attestation to both Docker Hub publishing workflows. Nothing has been run, so none of it is tested.

Registries found: Docker Hub only, as ${{ secrets.DOCKER_HUB_USER }}/graphmindset. There is no ghcr.io push. build-check.yml doesn't publish, so I left it alone.

Workflows changed:

• .github/workflows/docker-build.yml (on release; tags RELEASE_TAG and latest).
• .github/workflows/docker-build-main.yml (on push to main; tag main).

Changes in each:

• Labels: both workflows use plain docker build and docker push, not build-push-action. I added --label org.opencontainers.image.source=<server_url>/<repo> and --label org.opencontainers.image.revision=<sha> to the docker build command. I did not add docker/metadata-action, because there is no build-push-action step to pass its outputs to. So there are no manifest annotations, only labels.
• Permissions: neither job had a permissions block, so I added contents: read, id-token: write and attestations: write. packages: write isn't needed because nothing goes to ghcr.
• Digest: a new step resolves the pushed digest with docker buildx imagetools inspect <image>:<tag> --format '{{.Manifest.Digest}}'. In the release workflow it inspects the RELEASE_TAG tag, which points at the same image as latest.
• Attestation: actions/attest-build-provenance@v2 runs with subject-name: index.docker.io/${{ secrets.DOCKER_HUB_USER }}/graphmindset, the digest from the step above, and push-to-registry: true. It has the gh attestation verify oci://… --owner stakwork comment above it.

Existing tags, triggers, login and push steps are unchanged. Neither workflow sets any provenance or sbom option, so there is nothing to carry over there.