Fix bootc image export in CI

[ATAC-Helicopter]

What changed

• stop loading the deeply layered bootc image into Docker's classic local image store
• push directly from BuildKit when publication is requested
• run the complete root-filesystem verification during image composition
• reuse the same verification script for local container checks
• document cache-only behavior when publication is disabled

Why

The first Build OS container run completed composition but failed during the Docker import/export phase with max depth exceeded. Fedora Kinoite's layer history exceeds the classic Docker importer limit; this is not a product-image composition failure.

Impact

Published builds now go directly to GitHub Container Registry, while non-publishing builds retain their verified result in the BuildKit cache. Both paths avoid Docker's layer-depth limit.

Checks

• prototype/tests/run-static.sh
• workflow YAML parsing
• bash -n for the shared root-filesystem verification scripts
• git diff --check