Document SHA-256 container image signatures

When a new container image is pushed to Docker Hub, its SHA-256 signature should be easy to find in the repo so that consumers can verify that they are pulling down the container image that was originally built.

Start by locating the repository documentation and the Docker Hub image publishing workflow. Determine where each pushed image's SHA-256 signature should be recorded so consumers can find and verify it; done means the repository clearly exposes the signature for new images.

Written by the indexing model from the issue text.