Disable buildx provenance/SBOM attestations for the published image

QEMU cross-arch emulation hung indefinitely on the self-hosted Gitea
runner (likely no privileged Docker access), so the actual arch wasn't
the problem worth chasing. The far more common cause of "no matching
manifest" against a self-hosted registry is Buildx's default
provenance/SBOM attestation manifests, which not every registry
implementation (including Gitea's) resolves correctly when a client
requests a single-platform pull. Disabling both keeps the image a
plain single-manifest image, matching what a manual `docker push`
already produced and pulled fine.

.github/workflows/publish-container.yml

@@ -29,9 +29,6 @@ jobs:
             echo "image=$host/marvin/vboxstock" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
       - name: Set up Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -57,7 +54,8 @@ jobs:
         with:
           context: .
           push: true
-          platforms: linux/amd64,linux/arm64
+          provenance: false
+          sbom: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |