feat(ci): register OCI images with Artifact Hub

[castrojo]

Closes #47

Summary

• register each published OCI image with Artifact Hub's organization API
• push artifacthub-repo.yml ownership metadata at the artifacthub.io tag for Verified Publisher
• make registration idempotent and independently apply to each image
• pass repository secrets through the reusable workflow and mark the runbook implemented

Registration is skipped safely when ARTIFACT_HUB_KEY_ID and ARTIFACT_HUB_KEY_SECRET are not configured.

Verification

• git diff --check
• bash -n /tmp/artifacthub-step.sh (workflow step extracted from the YAML)