feat(config): add exportToCache field to DockerPkgConfig

Add optional exportToCache boolean field to DockerPkgConfig to control
whether Docker images are pushed directly to registries or exported to
cache for signing.

- Default: false (maintains backward compatibility)
- When true: images exported to cache instead of pushed
- Enables SLSA Level 3 compliance workflow

Co-authored-by: Ona <[email protected]>

Author: leodido

pkg/leeway/package.go

@@ -546,6 +546,11 @@ type DockerPkgConfig struct {
 	BuildArgs  map[string]string `yaml:"buildArgs,omitempty"`
 	Squash     bool              `yaml:"squash,omitempty"`
 	Metadata   map[string]string `yaml:"metadata,omitempty"`
+
+	// ExportToCache controls whether Docker images are exported to cache instead of pushed immediately.
+	// When true, images are saved as .tar files and go through the standard cache flow.
+	// When false (default), images are pushed directly to registries (legacy behavior).
+	ExportToCache bool `yaml:"exportToCache,omitempty"`
 }
 
 // AdditionalSources returns a list of unresolved sources coming in through this configuration