Fix: copy the release image to Docker Hub by digest

[SandObserver]

Summary

• Release: the build pushes only to ghcr.io/sandobserver/posteryard and outputs its digest. The Docker Hub login stays in the build job, so a missing token still stops the release before anything is pushed.
• New dockerhub-image job copies that digest to each docker.io/sandobserver/posteryard tag with docker buildx imagetools create, and skips a tag that already points at it. Re-running the failed job finishes a partial copy.
• The GitHub release waits for both jobs.
• CONTRIBUTING: the release copies the image to Docker Hub; re-run failed jobs after a failed copy.

Testing

All green, including actionlint and zizmor. The raw index hash matches the published digest of ghcr.io/sandobserver/posteryard:0.9.0, and its index holds both attestation manifests.

Checklist

• Format, lint, type checks and tests pass.
• DESIGN_VERSION bumped and tests/golden written again if rendered images change. Not needed: workflow only.
• CHANGELOG.md updated under Unreleased for user-visible changes. Not needed: release tooling only.