Scope docker hub login to push, and add attestations

[bjester]

Summary

Originally, the new container publishing workflow worked for Github but failed for Docker Hub. This was because the Docker Hub project was archived, and so after unarchiving it, publishing worked to Docker Hub.

This PR:

• Adds attestations to both Github and Docker publishs
• Adds explicit versions for all workflow actions
• Retains ordering change motivated by belows outdated summary

Outdated background

The new container publishing workflow worked for Github but failed for Docker Hub:

failed to push docker.io/learningequality/kolibri:0.19.3: push access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed

Looking at the documentation for the login-action, it mentions default token overriding. I don't think this will fix the issue, since it describes login tokens overriding Github's, but worth a shot.

Also adds attestations according to Github's docs

References

https://github.com/learningequality/kolibri/actions/runs/23910966630

[github-actions]

Build Artifacts

Asset type	Download link
PEX file	kolibri-0.19.5.dev233_geea9a86fa.d20260622.pex
Windows Installer (EXE)	kolibri-0.19.5.dev233+geea9a86fa.d20260622-windows-setup-unsigned.exe
Debian Package	kolibri_0.19.5.dev233+geea9a86fa-0ubuntu1_all.deb
Mac Installer (DMG)	kolibri-0.19.5.dev233+geea9a86fa.d20260622.dmg
Android Package (APK)	kolibri-0.19.5.dev233+geea9a86fa-0.2.0-debug.apk
Raspberry Pi Image	kolibri-pi-image-0.19.5.dev233+geea9a86fa.zip
TAR file	kolibri-0.19.5.dev233+geea9a86fa.d20260622.tar.gz
WHL file	kolibri-0.19.5.dev233+geea9a86fa.d20260622-py3-none-any.whl

Smoke test screenshot

Download screenshot

[DXCanas]

Seems… right? I don't know how to test this lol

And iirc, the issue with the publish had more to do with the fact that the repo was asleep; hopefully this addresses both?

[bjester]

Seems… right? I don't know how to test this lol

And iirc, the issue with the publish had more to do with the fact that the repo was asleep; hopefully this addresses both?

Yeah we fixed the publish issue so this mostly just adds attestations, which are good to have though. Will resolve the conflicts