docs: surface official container image provenance

[ruirui6946]

Summary

• add a prominent root README section naming the three official container registries
• link production users directly to the release-verification guide and recommend digest pinning
• document GHCR alongside Docker Hub and Alibaba Cloud ACR in the signing and verification flow
• list the published component image names and example GHCR/ACR verification targets

Why

OpenSandbox already publishes keyless-signed images and provenance attestations, but the official registry locations and verification path were hard to discover before deployment. The verification guide also omitted GHCR even though the release workflows sign and attest it alongside the other registries.

Impact

Documentation only. This does not change release workflows, image contents, runtime behavior, or public APIs.

The Docker Hub organization/profile/badge trust signals mentioned in #1265 require account-admin access and cannot be changed through this repository PR.

Validation

• cd docs && corepack pnpm install --frozen-lockfile
• cd docs && corepack pnpm docs:build
• git diff --check

Addresses the repository-scoped portion of #1265.