🤖 tests: follow-ups for the bug-bash sandbox image workflow (#5818) #5873

Follow-ups from the final readiness check of #5818 (merged in 752a624e15). Part of #5714 (B1). None of them blocked the merge.

1. Digest check on the first publish. The publish job uses buildx's default docker driver. The final check believes that containerimage.digest in the build metadata is the registry digest after the push, but did not verify it. After the first manual publish, compare the summary's digest with docker buildx imagetools inspect ghcr.io/coder/xum-bugbash-sandbox:<tag>. If they differ, the failure is safe: PR 2's anonymous pull by digest fails.
2. Protected environment for the publish job. A user with write access can dispatch the workflow from a branch whose copy of the file drops the github.ref check. An environment: that allows only main adds defense in depth. That user can already run any workflow from a branch, so this is not a new exposure.
3. Path filter. The pull_request path filter of bugbash-sandbox-image.yml does not include tests/bugbash/sandbox/build.test.ts. The test already runs in the normal unit lanes.
4. zizmor auditor persona. It flags the three write permissions of the publish job as undocumented-permissions (low severity), because each comment sits on the line above instead of inline. This is cosmetic.
5. Package visibility. A first-published package is private by default. PR 2's anonymous-pull gate needs it public. This is a manual owner step, held for approval.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $108.58