fix: disable provenance attestation for Forgejo registry compatibility

build-push-action@v7 generates OCI attestation manifests by default.
Forgejo's registry doesn't support OCI image index format with attestations,
causing the push to fail with "unknown". provenance: false disables this.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -139,6 +139,7 @@ jobs:
         with:
           context: .
           push: true
+          provenance: false
           tags: ${{ steps.tags.outputs.value }}
           build-args: BUILD_VERSION=${{ steps.tags.outputs.build_version }}
           cache-from: type=registry,ref=${{ env.IMAGE }}:cache