fix(image): allow the first official package publication

[soulbah]

Change

The official image job required ghcr.io/rootform-dev/rootform to exist and be public before its first push, so the first publication could not create the package. A missing package (HTTP 404) now lets the job publish the qualified images. Publication evidence is uploaded before the final visibility check, which names the package settings page when the package is not public; a re-run then finds the qualified images present and only verifies visibility. An existing package must still be public before any push.

Validation

• actionlint on the workflow.
• bun scripts/validate-repository.ts: the image workflow keeps its ownership and visibility contract (three public visibility checks, no visibility change by the workflow).

[rootform-contribution-delivery]

Contribution progress

Source: ff40bd3548f662360a83bed195464e633e1850f9

Selected validations: docs, cli, dialects, policies, examples, distribution, tooling, generated. Repository safety always runs.

Stage	Status
Public validations	Passed (checks)
Documentation preview	Passed (open preview)
Development integration	Passed
Staging sites	Passed
Release	Not yet released

Applicable consumers are synchronized on their development branches and the staging sites. Releases are published from main; the Release row follows them.