chore(release): re-enabling ECR Public requires coordinated changes in 4 sites, no end-to-end test

gh issue create --title "chore(release): re-enabling ECR Public requires coordinated changes in 4 sites, no end-to-end test" --label "chore,audit,priority:high" --body "## Finding

ECR Public publishing is currently disabled (commented out). Re-enabling requires changes in at least 4 places in release.yml:
1. The build job's push step (login to ECR Public).
2. The verify-tags / publish-images matrix.
3. The cosign signing step (different OIDC audience?).
4. The CycloneDX SBOM attestation target.

There is no end-to-end test that exercises the ECR Public path; only the ghcr.io path is exercised by the contract test.

## Affected code

- .github/workflows/release.yml — ECR Public publishing sites

## Reproduction

N/A — code review.

## Suggested fix

Either:
- Document the re-enable procedure in AGENTS.md / docs/release.md.
- Or remove the dead code (commented-out ECR sections) entirely.

The first option is preferred because the ECR path was deliberately scaffolded for future use.

## Source

F2 audit 2026-09-03 (workflows audit). Reporter: subagent-pekodbj7.

## Related

- Part of EPIC #[epic-number]
- Closes: #NONE (no existing issue)
- Related: M4 (ECR Public attestation is dead code), M5 (dockerhub_image / ecr_image referenced before guard)"