[CI] Label manually built images with the checked-out revision

### Environment Setup

VIDEX Version: `8cad1b0f07236bc9067afcc36765b35d736e0a14` (current `main` as of 2026-08-22)
Workflow: `.github/workflows/publish-videx-server.yml`
Trigger: `workflow_dispatch` with `inputs.ref` different from the ref selected in the GitHub Actions UI
Audit method: GitHub Actions context semantics and static workflow trace

### Observed vs Expected Behavior

The checkout step supports a manually supplied source ref:

```yaml
- uses: actions/checkout@v4
with:
ref: ${{ inputs.ref != '' && inputs.ref || github.ref }}
```

However, the OCI metadata later records:

```yaml
org.opencontainers.image.revision=${{ github.sha }}
```

`actions/checkout` changes the worktree but does not rewrite the workflow event's `github.sha` context. For a manual run where `inputs.ref` points to another branch, tag, or commit, the image is built from the checked-out input ref while its `org.opencontainers.image.revision` label still points to the event/UI-selected SHA.

Expected behavior:

The image revision label should identify the exact commit returned by `git rev-parse HEAD` after checkout, for both tag pushes and manual custom-ref runs.

### Impact

Published artifact provenance can point to the wrong source commit. This makes image auditing, incident investigation and reproduction unreliable precisely for the custom-ref path the workflow explicitly supports.

### Why this report has no PR

A candidate fix would expose the checked-out SHA as a step output and use it in the metadata labels. The audit cannot safely dispatch or publish a test image, and changing a release workflow without exercising its tag and custom-ref paths would not meet the repository's validation bar. Maintainers also need to decide whether the same checked-out revision should be used in concurrency keys, tag metadata, and any future attestations.

Suggested validation: run a non-publishing manual workflow with the UI ref and `inputs.ref` deliberately different, print both `github.sha` and `git rev-parse HEAD`, and assert generated OCI metadata uses the latter.

Read .github/workflows/publish-videx-server.yml, focusing on the checkout and OCI metadata steps. Run a non-publishing manual workflow with the UI ref and inputs.ref deliberately different, and compare github.sha with git rev-parse HEAD. Done means the generated image metadata identifies the checked-out commit for tag pushes and custom-ref runs.

Written by the indexing model from the issue text.