ci: embed promote-to-prod VSA producer (RFC-044.5 P4) [sc-18869]

[devkoriel]

What

Embeds a self-contained promote-to-prod SLSA VSA producer into this repo and wires the release pipeline to call it, so challenger's released image (ghcr.io/chronicleprotocol/challenger-go) earns a promote-to-prod Verification Summary Attestation.

Two changes, one commit:

1. New .github/workflows/promote-to-prod.yaml — a verbatim copy of the canonical producer chronicleprotocol/actions-workflows/.github/workflows/promote-to-prod.yaml@main. challenger is a public repo and cannot call the private actions-workflows reusable, so the producer is inlined here, exactly like the existing embedded sign-image.yaml signer. The workflow body is byte-for-byte identical to the canonical; the only addition is a comment block at the top noting it is an embedded copy kept in sync manually. Confirmed via cmp against a freshly fetched canonical.
2. .github/workflows/docker.yml — adds an attest_promotion_vsa job right after the existing sign job, mirroring its needs: build-and-push and if: ${{ needs.build-and-push.outputs.digest != '' }} gating. It calls this repo's own embedded producer at @main, the same reference style as the sign-image.yaml call. build-and-push already exposes outputs.digest and outputs.tags, which feed the producer.

Why the SAN matters

Because the producer runs in challenger, its keyless cosign SAN is https://github.com/chronicleprotocol/challenger/.github/workflows/promote-to-prod.yaml@refs/heads/main. The (Audit) verify-chronicle-promotion-vsa Kyverno IVP attestor will be widened separately (not in this repo, not in this PR) to accept that SAN.

allow_unverified_ci: true

Set on the call so the producer defers tests-green to its own Trivy gate plus the CODEOWNERS-reviewed app-of-apps digest-pin PR (the deploy approval of record), rather than failing closed on a cross-repo CI read. Safe default for this in-repo release path.

Resolution note

The uses: points at this repo's own promote-to-prod.yaml@main, which resolves once this PR merges, exactly as the embedded sign-image.yaml reference did. The wiring validates on the next challenger release.

Test

• actionlint .github/workflows/docker.yml and actionlint .github/workflows/promote-to-prod.yaml both exit 0 (run against the pushed branch content). actionlint does not resolve the cross-repo uses ref to the not-yet-merged @main file; that is expected, same as the sign-image embed.
• Confirmed only these two files changed (compare API: docker.yml modified, promote-to-prod.yaml added).
• Confirmed the embedded body is byte-for-byte identical to the canonical producer.

Pushed via the GitHub API (not git push) to avoid the local pre-push hook that runs tests and blocks workflow-only changes.

Review only. Do not merge without a maintainer pass.