fix(ci): restore preflight image cleanup marker and remove obsolete publish-container tests

- Restore build_attempted=1 in ci-preflight.sh so the exit trap
  removes the temporary image tag
- Remove publish-container.test.ts and its harness (publication
  workflow and script were removed in fff284aa)
- Update deploy-workflow-contract and docker-build-contract tests
  to assert that publication has been removed

src/lib/docker-build-contract.test.ts

@@ -58,14 +58,8 @@ it("builds with fixtures and excludes installation secrets from every stage", ()
 	expect(updater).toContain("target=/app/.env,readonly");
 	expect(updater).toContain("--target migrations");
 });
-it("verifies portability before publishing and uses committed build context", () => {
-	const publish = readFileSync("scripts/publish-container.sh", "utf8");
-	expect(publish).toContain("git archive HEAD");
-	expect(
-		publish.indexOf("node scripts/verify-portable-image.mjs"),
-	).toBeLessThan(publish.indexOf("regctl image import"));
-	expect(publish).toContain("--password-stdin");
-	expect(publish).not.toContain(":latest");
+it("does not reference a container publication script", () => {
+	expect(() => readFileSync("scripts/publish-container.sh", "utf8")).toThrow();
 });
 
 it("does not prerender installation metadata into a shared image", () => {