ci(images): publish validated master-fpm channel

[vitormattos]

Closes #75.
Part of #47.
Supersedes #62.

This PR turns the existing Nextcloud Server master validation workflow into the publication path defined by the image contract.

Publication behavior:

• PRs build amd64/arm64, run Trivy, and run runtime acceptance, but never publish;
• pushes to main, the daily schedule, and manual dispatch may publish;
• each architecture is pushed only after its own scan and runtime acceptance pass;
• the :master-fpm multi-platform manifest is created only after both architecture jobs succeed;
• no :35, :stable35, :main, or :latest development aliases are published.

Traceability:

• resolves nextcloud:stable-fpm to an OCI digest before building;
• records the exact SHA-512 of latest-master.tar.bz2;
• records source repository, repository revision, build timestamp, channel, upstream source, resolved base digest, and runtime variant as image labels.

The upstream daily artifact does not expose a reliable Nextcloud Git commit SHA, so this PR records the exact verified artifact digest instead of inventing one.