Stop publishing release images to GHCR

[gontzess]

Why

Connector release images no longer need to be published to GHCR. Keeping the GHCR path means extra registry auth, extra image metadata, and extra attestation verification for an output that is no longer consumed.

What this changes

• Removes the GHCR image from the Docker GoReleaser template.
• Removes GHCR login from Docker publishing and release verification.
• Records only ECR Public image metadata for public Docker images.
• Removes GHCR image attestation verification from the release validation script.
• Updates release workflow docs, protobuf comments, and the workflow diagram.

Validation

• go test ./...
• git diff --check
• YAML parse for .github/workflows/release.yaml
• Rendered .goreleaser-docker-oci-template.yaml.tmpl with sample values and parsed it as YAML
• make protogen
• make docs
• Live release v0.1.122-test.8: Docker enabled, no GHCR login step, ECR Public publish, manifest publication, registry API recording, and release verification passed
• Rebased onto main after Remove legacy release recording lambdas #69 merged; reran go test ./..., git diff --check, and YAML parse