M12.1a: harden dual-registry post-release audit

[pgousdal]

Fixes the v0.2.1 post-release audit failure without moving or recreating the release tag.

• replace fragile docker manifest inspect calls with Buildx imagetools inspect --raw
• retry registry metadata/digest resolution to tolerate immediate post-publish propagation lag
• keep amd64/arm64 coverage checks for both GHCR and Docker Hub
• keep exact-digest parity, Cosign verification, labels and /healthz runtime qualification unchanged

After merge, re-run the existing v0.2.1 audit via workflow_dispatch.