[SandObserver]

Summary

• Pass --org with the Docker Hub namespace to docker scout attestation add. Scout refuses the referrer attach without it.
• Move the VEX job from release.yml into a new vex.yml, called by the release with the image digest and version.
• Add a workflow_dispatch trigger to vex.yml that takes a published version, resolves its digest from Docker Hub and attaches the statements.
• Keep the job non-blocking when called by the release, and failing when run by hand.

Testing
All green. Release workflow tests now read vex.yml and cover the dispatch input, the version filter and --org.

Changelog

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.