Use docker buildx imagetools create for multi-arch manifest creation

[DeathGun44]

PR description

Docker 29 defaults to the containerd image store, which preserves BuildKit provenance
attestations on push. This turns per-arch images into OCI indices (manifest lists),
causing docker manifest create to reject them as sources.

Switch to docker buildx imagetools create which handles OCI indices natively and
combines create+push into a single atomic command. Also removes the --provenance=false
workaround added in #9817, re-enabling SLSA provenance attestations.

Transition context: A standalone GitHub Actions workflow for multi-arch builds is being introduced in parallel (see #10203 ). This PR patches the Gradle tasks so they remain functional on Docker 29 during the transition period, honoring the co-existence strategy. Once the GHA workflow is proven stable, the Gradle Docker tasks will be deprecated in a follow-up PR.

Changes:

• Remove --provenance=false from distDocker
• Replace 3-task chain (manifestDockerCreate → manifestDockerPush → manifestDocker) with a single manifestDocker task using docker buildx imagetools create
• Replace 3-task chain (manifestDockerReleaseCreate → manifestDockerReleasePush → manifestDockerRelease) with a single manifestDockerRelease task

No CI workflow YAML changes needed — task names called by develop.yml, draft-release.yml, and docker-promote.yml are preserved.

Note: Published images will now be OCI Image Indices. All modern runtimes (Docker ≥ 20.10, containerd ≥ 1.4) handle this transparently.

Fixed Issue(s)

fixes #9818

Thanks for sending a pull request! Have you done the following?

• Checked out our contribution guidelines?
• Considered documentation and added the doc-change-required label to this PR — no doc changes needed, internal build tooling only
• Considered the changelog and included an update if required — no changelog entry needed, internal CI infrastructure change
• For database changes considered compatibility — not applicable

Locally, you can run these tests to catch failures early:

• spotless: ./gradlew spotlessApply
• unit tests — not applicable, no source code changes
• acceptance tests — not applicable
• integration tests — not applicable
• reference tests — not applicable
• hive tests — not applicable, no Engine/RPC changes