Merge branch 'main' into cursor/fix-gh-jq-attestation-2bf5

gh api --jq accepts one expression; a separate -r flag is parsed as a
second argument and fails with 'accepts 1 arg(s), received 2', breaking
publish-server-image on main after the attestation gate landed.

Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>

.github/workflows/publish-server-image.yml

@@ -263,8 +263,8 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
-          owner_type="$(gh api "repos/${GITHUB_REPOSITORY}" --jq -r '.owner.type')"
+          owner_type="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.owner.type')"
-          private="$(gh api "repos/${GITHUB_REPOSITORY}" --jq -r '.private')"
+          private="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.private')"
           if [[ "$owner_type" == "User" && "$private" == "true" ]]; then
             echo "enabled=false" >> "$GITHUB_OUTPUT"
             echo "Skipping registry attestation: unavailable for private repositories on personal accounts."