fix(images): emit ::error:: on stdout so the guard failures annotate

[LukasWodka]

Follow-up to #422 (thanks for merging). Bugbot found this class on tracebloc/client#497 and I audited my other workflows from today — publish-images.yml had it five times.

GitHub Actions parses workflow commands from stdout only. Every ::error:: in that file went to >&2, so each guard failed the step with no annotation — the reader gets a bare red X and has to dig through the log to find out why. That defeats the point of the carefully-worded refusals:

• refusing a non-develop/staging ref
• refusing a non-internal channel tag
• a build that produced no digest
• refusing to publish a partial single-arch index (the client#186 ImagePullBackOff guard)
• a published index missing an arch

All five now write to stdout, so they annotate on the PR/run as intended. No logic change; the messages and exit codes are identical.

actionlint + shellcheck clean at the CI-pinned versions.

Worth knowing for the wider codebase: .github/workflows/merge-settings-drift.yml (already merged) has one instance of the same pattern in its zero-repos guard — I'll fix it separately rather than reach across repos in this PR.

---

Note

Low Risk
CI-only stderr→stdout tweak for workflow commands; no build, publish, or application logic changes.

Overview
GitHub Actions workflow commands only apply when ::error:: is written to stdout. In publish-images.yml, five guard failures still echoed those lines to stderr (>&2), so steps failed without the intended run/PR annotations.

This change removes >&2 on those echoes only—no change to messages, exit codes, or guard logic. Affected guards: refusing non-develop/staging refs, refusing non-internal channel tags, missing build digest, refusing a partial single-arch manifest merge, and a published index missing linux/amd64 or linux/arm64.

^{Reviewed by Cursor Bugbot for commit 38daba8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[LukasWodka]

👋 Heads-up — Code review queue is at 36 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• .github#109 — fix(fr-gate): an ancestry-only promotion has nothing to gate · author: @LukasWodka · no reviewer assigned
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
• backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
• backend#1332 — feat(check-model): allow KNN/GaussianProcess on a single-edge owned dataset (#923 follow-up) · author: @divyasinghds · no reviewer assigned
• backend#1353 — chore(ci): baseline historical gitleaks findings + wire caller · author: @LukasWodka · no reviewer assigned
• backend#1361 — feat(tasks): bound ExperimentQueue growth for PAUSED experiments (backend#1351) · author: @saqlainsyed007 · reviewer: @saadqbal
• claude-skills#14 — feat(skill): add tracebloc-frontend-app skill · author: @waqaskhanroghani · no reviewer assigned
• claude-skills#15 — feat(skill): add tracebloc-design-system skill · author: @waqaskhanroghani · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 38daba8. Configure here.}