fix(images): hide unpublished Utah testing image commands and attestations

[castrojo]

Problem

docs/utah.mdx and the generated image catalog (static/data/images.json) published bootc switch and cosign verify/attestation commands for ghcr.io/projectbluefin/utah:testing, even though that tag has never been pushed (skopeo inspect docker://ghcr.io/projectbluefin/utah:testing returns manifest unknown).

Root cause: buildTopStreams' fallback path in scripts/fetch-github-images.js fabricated a switch command for the first streamOrder entry whenever none of the registry's tags matched, even if the registry had no tags at all. buildSecurityInfo had no way to know a tag was unpublished, so it always rendered live verify/attest commands based on repo signing config alone.

Fix

• Added isImagePublished(spec, tagSet) to check whether any of a product's streamOrder tags actually exist in the registry before building switch/security commands.
• In buildProduct, when a product's primary tag isn't published, streams/testingStreams stay empty and security is cleared (hasAttestation: false, no commands). The product output now carries an explicit imagePublished: false flag.
• ImagesCatalog.tsx now renders an "awaiting initial release" message in the Streams and Signing/SBOM sections instead of an empty tag list or unpublished commands when imagePublished is false.
• Regenerated the Utah entry in static/data/images.json to reflect the new state immediately (rather than waiting for the next scheduled fetch job).

Testing

• npm run test (486 tests, all passing)
• npm run typecheck (no new errors; pre-existing unrelated error in MusicPlaylist.tsx from an untracked generated data file)
• npx eslint on changed files (no new warnings/errors)
• npx prettier --check on changed files

Fixes #1081

— hive: backend=copilot model=claude-sonnet-5

🐝 Hive Agent: contributor | SHA: 89ef75a1