tech debt: restore provenance for `docker buildx bake` temporary-registry builds

Context

PR #794 disables Buildx's default provenance attestation for Bake builds pushed through the temporary registry. This is a tactical workaround for #793, not a decision to stop producing provenance permanently.

With push-by-digest, Buildx can report containerimage.digest for an OCI index that contains both the platform image manifest and provenance attestation manifest(s), rather than for the platform image manifest itself. Bakery's merge path currently assumes that every digest in its build metadata is a platform image manifest and passes it directly to oras manifest index create.

When the source digest is an index, ORAS creates a child descriptor without platform. The merged image index is then invalid for SOCI v0.13.0, which rejects such a child with manifest should have proper platform.

Re-enable provenance when

Replace the manifest-only assumption in the Bake metadata/merge path:

1. Resolve each containerimage.digest before adding it to the merged index.
2. If it is an image manifest, retain the current path.
3. If it is an OCI index, select the platform image-manifest child that matches the metadata's build platform; do not select an unknown/unknown attestation descriptor.
4. Preserve the provenance output while publishing the final multi-platform image. Decide and test whether to carry the attestation descriptors in the merged index or publish them as OCI referrers for their subject image manifests.
5. Fail clearly if the index has zero or multiple matching platform image manifests; never emit a descriptor without platform.

Acceptance criteria

• Bake + push-by-digest succeeds with default provenance enabled for amd64 and arm64 builds.
• The final image index has a platform object for every platform-image descriptor.
• The final image has discoverable provenance for every built platform.
• Unit fixtures cover both metadata shapes: a leaf image-manifest digest and an index digest containing image and attestation descriptors.
• An integration/CI check inspects the final raw index and verifies platform descriptors and provenance discovery before removing the *.attest=type=provenance,disabled=true workaround.

Related: #793, #794

Start at the Bake metadata/merge path that consumes containerimage.digest, then inspect the existing unit fixtures and CI or integration checks around push-by-digest and the temporary registry. Cover both leaf-manifest and OCI-index metadata, and verify that the final raw index has platform descriptors and discoverable provenance for each built platform before removing the provenance workaround.