[SandObserver]

Summary

• Pass the image to docker scout attestation add as docker.io/<namespace>/stackyard@<digest>. The command reads a registry:// scheme as a host name.
• Pin the address form in the release workflow tests.

Testing
All green. A run of vex.yml from this branch attached the statements to both 1.20.0 platform images.

Changelog

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.