M0.15: qualify release and publish path

[pgousdal]

Implements M0.15 release/publish qualification before creating the next immutable release tag.

Changes:

• replace Buildx/awk digest resolution in sign-release.yml with Skopeo;
• replace Buildx/awk digest resolution in scripts/qualify_signature.sh with Skopeo;
• update signature verification workflow to install/use Skopeo;
• add Release publish qualification PR gate that validates the release path and verifies known-good signed v0.2.3 through the current implementation;
• document v0.2.4 acceptance criteria.

No existing tag is moved. The intended next release is v0.2.4 from the exact qualified post-merge main commit.