Improve provenance completeness and image signing practices

## Description:

Our current Cosign/SLSA setup works, but does not fully follow supply-chain best practices. The main issues are related to provenance completeness, digest handling, and minor SBOM inconsistencies.

## Observations:

* Incomplete SLSA provenance
* Provenance reports completeness.environment=false and completeness.materials=false because the build is performed outside the SLSA generator workflow.
* Build and provenance are decoupled
* Images are built and pushed in a custom job, while provenance is generated later in a separate workflow.
* Fragile digest handling and signing
* Digests are parsed from docker push output, and only the :latest digest is signed. Release/version tag digests may not be explicitly signed.
* SBOM filename mismatch
* CycloneDX JSON SBOMs are written with a .xml filename, which is misleading.