[FEATURE] Release coordinates for images, bases, charts and binaries #3664

Defines where each release publishes its images, kustomize bases, Helm charts and command-line binaries, so provider repositories and operators can reference them before the artifacts exist.

Tracks the "Release coordinates" contract of the Extensible Install Roadmap.

Owner: kustomize release workstream (images, bases) and Helm workstream (charts). Consumers: GKE workstream, operators.

Current state (0b635b80, v1.0.0-rc.3):

• Images publish from .github/workflows/release.yaml (ci: automate release artifact build and publish #2112, Releases publish the Kubernetes Secrets credential provider image #3220, Releases publish the envoy-dataplane image #3252), upstream only, and pull anonymously. Path is ghcr.io/agent-substrate/substrate/<cmd path>:<tag>; references are by tag, not digest.
• kubectl-ate binaries publish for linux and darwin (amd64, arm64) with .sha256 files. No windows binary.
• No charts, no published bases.

Specification (Proposed, pending the hosting decision in #2730).

• Images: record the actual path scheme (ghcr.io/agent-substrate/substrate/<component>) or change it before 1.0. Multi-arch (amd64, arm64). Release bases reference images by digest. Every entry in ate-setup's image component list is published, plus envoy-dataplane. Decide whether the ate-setup image is published (the bootstrap Job in [FEATURE] Install Bootstrap #3175 needs it).
• Charts: oci://ghcr.io/agent-substrate/charts/agent-substrate-crds, .../agent-substrate-<stage>, .../agent-substrate. Chart version and app version equal the release version without the leading v.
• Bases: release/ on the tag v<version> ([FEATURE] Release Layouts #3176), or an OCI artifact if that option is chosen.
• Command-line tool: kubectl-ate for linux and darwin (amd64, arm64), and windows (amd64) if chosen, with checksums.
• Publishing gate: only the upstream repository publishes; forks run a dry run.

Stability. Paths and names are a compatibility surface from 1.0.

Enforcement. After publishing, the release workflow pulls every image and chart anonymously and installs from the published bases on kind.

Parent Issue: #3160