ci: Build operator images via the shared builder workflow

[dervoeti]

Follow-up to stackabletech/actions#122. This switches the operator image build over to it.

Currently every operator builds in its own top-level build.yaml, which is SLSA Build Level 2. GitHub's documented mechanism for Build Level 3 is that the build runs in a reusable workflow, separate from the workflow calling it (see https://docs.github.com/en/actions/concepts/security/artifact-attestations#slsa-levels-for-artifact-attestations). Delegating to stackabletech/actions/.github/workflows/reusable_build_container_image.yaml gives us that split, and all 16 operators end up sharing one build definition instead of 16 generated copies.

Only source-level build parameters are passed, so this workflow cannot hand the builder a digest and obtain provenance for an image it did not build.

• Each per-architecture image is now attested in the job that pushed it, not just the index.
• build-container-image is now a call to the shared builder instead of a runner/arch matrix. The builder builds both architectures, pushes and attests each one, then assembles, signs and attests the index.
• publish-index-manifest, provenance-oci and provenance-quay are gone. The builder does all three.
• New operator-version job, which only computes the version and exposes it as an output. publish-helm-chart and openshift-preflight-check now take it from there instead of from the build job.
• detect-changes, cargo-udeps, publish-helm-chart, openshift-preflight-check, finished and notify are otherwise unchanged.

The sed that rewrote Cargo.toml is gone. The builder does it through its cargo-workspace-version input, because caller-supplied shell must not run on the builder's runners.

It is needed at all because the operator binary reports CARGO_PKG_VERSION (as built_info::PKG_VERSION), which ends up in the startup log and is passed to print_yaml_schema(), so it is stamped into the generated CRDs. The VERSION build argument only feeds image labels and the README text, so it cannot replace it.

Dropped setup steps

The image build job loses its Nix install, its pinned Rust toolchain and its apt build dependencies. These are left over from when the operator was compiled on the runner. The compile now happens inside the container, where ubi10-rust-builder supplies its own toolchain through its ONBUILD stage.

cargo-udeps does genuinely compile on the runner, so it keeps its own apt step and its own toolchain install and is untouched.