fix(ci): restore preflight image cleanup marker and remove obsolete publish-container tests

- Restore build_attempted=1 in ci-preflight.sh so the exit trap
  removes the temporary image tag
- Remove publish-container.test.ts and its harness (publication
  workflow and script were removed in fff284aa)
- Update deploy-workflow-contract and docker-build-contract tests
  to assert that publication has been removed

src/test/publish-container-harness.sh

@@ -1,29 +0,0 @@
-git() { if [ "$1" = rev-parse ]; then echo "$TEST_SHA"; fi; }
-tar() { cat >/dev/null; }
-node() { echo "verify $*" >> "$TEST_DIR/calls"; }
-docker() {
- echo "docker $*" >> "$TEST_DIR/calls"
- if [ "$1" = login ]; then cat >/dev/null; return; fi
- if [ "$1 $2" = "image inspect" ]; then
-  if [[ "$*" = *org.opencontainers.image.revision* ]]; then echo "$TEST_SHA"
-  elif [[ "${@: -1}" = *verified-* ]]; then
-   case "$SCENARIO" in verified) echo sha256:candidate ;; mismatch) echo sha256:other ;; *) return 1 ;; esac
-  else echo sha256:candidate; fi
- fi
-}
-export -f git tar node docker
-
-curl() {
- local output="${@: -1}"
- cat > "$output" <<'MOCK'
-#!/usr/bin/env bash
-echo "regctl $*" >> "$TEST_DIR/calls"
-if [[ "$1 $2" = "image copy" && "$SCENARIO" = upload-fails ]]; then exit 1; fi
-if [[ "$1 $2" = "manifest get" ]]; then
- if [[ "$SCENARIO" = wrong-config && "$3" != ocidir:* ]]; then echo sha256:wrong; else printf "sha256:%064d\n" 0; fi
-fi
-MOCK
-}
-sha256sum() { cat >/dev/null; [[ "$SCENARIO" != bad-checksum ]]; }
-uname() { echo x86_64; }
-export -f curl sha256sum uname