fix(release): resolve in-toto attestation UUID in wait-for-chains

[infernus01]

Changes

Summary

• Fix wait-for-chains inline task to resolve the correct Rekor
  UUID (in-toto attestation) instead of the per-image signature
  (hashedrekord) entry
• Port of fix: resolve in-toto attestation UUID in wait-for-chains pipeline#10363 to this repo

Problem

The chains.tekton.dev/transparency annotation on the publish-images
TaskRun points at a hashedrekord Rekor entry. This entry contains a
bare signature with no .Attestation payload, so the release notes
verification commands (rekor-cli get --uuid ... | jq -r .Attestation)
return empty. Verified broken on: chains v0.28.1, chains v0.29.0,
pruner v0.4.0, pruner v0.4.1.

Fix

Instead of trusting the transparency annotation, the task now:

1. Reads the IMAGES result from the publish-images TaskRun
2. Searches the Rekor index for all entries matching the first
   image digest
3. Selects the entry with body kind intoto
4. Falls back to the annotation-based approach if not found

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

• Run make test lint before submitting a PR
• Includes tests (if functionality changed/added)
• Includes docs (if user facing)
• Commit messages follow commit message best practices

See the contribution guide for more details.

Release Notes

NONE

/kind bug

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign khrm after the PR has been reviewed.
You can assign the PR to them by writing /assign @khrm in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 25.45%. Comparing base (19d139a) to head (c1de1f3).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3859      +/-   ##
==========================================
+ Coverage   25.41%   25.45%   +0.03%     
==========================================
  Files         450      451       +1     
  Lines       23607    23665      +58     
==========================================
+ Hits         5999     6023      +24     
- Misses      16918    16951      +33     
- Partials      690      691       +1     

Flag	Coverage Δ
unit-tests	25.45% <ø> (+0.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.