Give images/ independent versioning (middle ground before a repo split)

[RonaldHensbergen]

Context

Per discussion #530, @SemTiOne prefers a middle-ground approach over a full repo split: keep images/** in this repo, but give it an explicit CODEOWNERS boundary and formalize its already-existing independent tag/release cadence, revisiting a real split only if contributor count or CI time become a bottleneck.

Scope (minimal)

1. CODEOWNERS boundary — add an explicit /images/ entry to .github/CODEOWNERS (currently images fall through to the repo-wide * default with no distinct line).
2. Formalize the existing tag scheme as the release record (no new GitHub Release object) — publish-images.yml already computes and pushes per-image tags (base version from dagster==/apache/superset:/dbt-core==, optional variant- prefix, plus sha-<12> and latest) to GHCR/Docker Hub, and tests/fixtures/signed-images.json already tracks the currently-published digest per image. Document this existing scheme as the authoritative "release" for images — no new tagging/release workflow needed.
3. Docs — add a short "Versioning" section to docs/image-scanning.md (or a new docs/image-versioning.md) stating: images are versioned independently of the CLI (pyproject.toml/CHANGELOG.md/vX.Y.Z tags only cover the CLI), the tag scheme above is the source of truth for what's published, and tests/fixtures/signed-images.json is where to look up the currently-published digest per image.

Explicitly out of scope

• No repo split.
• No new GitHub Release objects/workflow for images.
• No changes to publish-images.yml's tag computation itself (already sufficient).

References

• Discussion Split images/ into a separate repo now that #407 makes them optional at deploy time? #530
• .github/workflows/publish-images.yml
• tests/fixtures/signed-images.json
• docs/image-scanning.md