Verify OIDC image publishing end-to-end with an rc tag and document the pipeline

## Motivation

The OIDC ruleset, environment claim, multi-arch build, and tagging logic can only be proven against the live Docker Hub org. An rc tag exercises the whole chain without touching `latest`.

## Details

1. Push the next rc tag (or rerun via `workflow_dispatch` on an existing rc tag) and watch the full chain: `build-wheels` → `docker-images`.
1. Verify on Docker Hub: all seven `lablup/backend.ai-*` repositories (including `lablup/backend.ai-agent`, BA-7271) received the version tag, both `linux/amd64` and `linux/arm64` manifests exist, and `latest` was NOT moved (rc is a prerelease).
1. Verify OIDC: workflow logs show token-exchange login (no secret usage); confirm a run outside the `deploy-to-dockerhub` environment cannot log in (ruleset rejects, visible in the connection's Failures tab).
1. Smoke-test images: `docker run lablup/backend.ai-manager: python -c "import ai.backend.manager"` (or equivalent entrypoint check). For the agent image, additionally run the DooD end-to-end check from BA-7271 (socket mount + path parity + host network spawns a kernel).
1. On the next final release, confirm `latest` is applied.
1. Documentation in the same PR series: `scripts/README.md` rows for new scripts, workflow header comment describing the OIDC setup (connection ID variable, environment name), and any operator notes for rotating/re-creating the OIDC connection.

Depends on: all other tasks in the epic.

## Success Criteria

- One rc and one final release published images correctly with OIDC-only auth.
- Negative test confirms the ruleset blocks non-release contexts.
- Documentation updated.

JIRA Issue: BA-7270

Start with the build-wheels → docker-images workflow chain and the existing scripts/README.md entries. Run an rc-tag or workflow_dispatch publication, verify the seven Docker Hub repositories, manifests, OIDC logs, negative ruleset test, and smoke checks. Done means one rc and one final release pass the stated checks and the workflow and operator documentation is updated.

Written by the indexing model from the issue text.