Migrate from Publish to BCR app to workflow (#50)

## Summary
- Add `.github/workflows/publish.yaml` that uses the
`bazel-contrib/publish-to-bcr` reusable workflow to automate BCR
publishing after releases
- Update `release.yml` to call the new publish workflow after a
successful release and bump `release_ruleset` from v6 to v7.2.2
- Add required permissions for artifact attestations (`id-token: write`,
`attestations: write`)

🤖 Generated with [Claude Code](https://claude.com/claude-code)