fix(ci): restore runtime image publication with isolated Buildx

[jiangxt2]

Description

This PR restores the IT Runtime Image publication path after the data-ingestion runtime profile began declaring verified domestic mirror inputs.

Local runtime builds continue to pull digest-pinned domestic mirror images, verify their digests, and pass Docker daemon-local tags to the default builder. GitHub Actions now explicitly selects canonical digest-pinned references for its isolated docker-container Buildx builder, where daemon-local tags are not visible, while retaining the existing registry-backed cache.

Runtime identity, image validation, publishing semantics, dependencies, and inference behavior are unchanged.

Related issues

None.

Additional information

• uv run --locked --no-sync pytest tests/tools/test_tributo_it.py tests/integration/test_it_component_versions.py -q — 49 passed.
• Ruff lint and format checks passed for the changed Python files.
• The required PR pre-check static layers passed; its Python 3.12 and 3.13 unit suites completed without a recorded test failure.
• Documentation static checks, strict Sphinx build, and spelling build passed.
• git diff --check and the pre-commit hooks passed.
• The branch IT Runtime Image workflow passed on commit 8aa57a4 with the isolated docker-container Buildx builder, including the runtime build, registry-cache export, image validation, and immutable GHCR publication.