Fix build-and-push workflow failing with GHCR secondary rate limit

[Copilot]

Pushing multiple tags (4.0.11, 4.0, 4, latest) to both GHCR and Docker Hub simultaneously with multi-platform (amd64+arm64) builds creates a burst of concurrent manifest requests that trips GitHub's secondary rate limit (HTTP 403).

Changes

• Retry logic: Wrapped docker/build-push-action with Wandalen/wretry.action@v3 — retries up to 3× with a 60s delay, handling transient rate limit hits without manual re-runs
• Action upgrade: docker/build-push-action v5 → v6
• Digest extraction: wretry.action surfaces the wrapped action's outputs as a JSON blob in steps.build.outputs.outputs; added an explicit jq-based extraction step with a null guard before passing to attestation

- name: Build and push Docker image
  id: build
  uses: Wandalen/wretry.action@v3
  with:
    action: docker/build-push-action@v6
    with: |
      ...
    attempt_limit: 3
    attempt_delay: 60000

- name: Extract build digest
  id: digest
  run: |
    DIGEST=$(echo '${{ steps.build.outputs.outputs }}' | jq -r '.digest')
    if [ -z "$DIGEST" ] || [ "$DIGEST" = "null" ]; then
      echo "ERROR: Could not extract image digest from build outputs"
      exit 1
    fi
    echo "digest=$DIGEST" >> $GITHUB_OUTPUT