Wire reusable promote workflows to pass the attestation path

[toddysm]

Part of #146. Depends on the scan-image, scan-sbom, and attach-scan-report
children.

Wire both reusable workflows to pass the new attestation path from the scan
step into attach-scan-report.

Tasks

• _promote-from-quarantine.yml: pass scan.outputs.attestation-path to
  attach-scan-report.
• _promote-from-quarantine-sbom.yml: same, from the SBOM scan step.
• Confirm no new inputs/secrets/permissions are required.

Validation

• actionlint + shellcheck -S warning on changed run blocks clean.