#40 release(agent-relay): 0.3.3 pins the attested relaycast-self-host 12.7.0 image

Follow-up to #37/#38 (release lane). relaycast #619 and #618 are merged, so the Relaycast customer image is rebuilt from relaycast main bf713d86 by the reviewed publish-container workflow (run https://github.com/AgentWorkforce/relaycast/actions/runs/41717074565):

ghcr.io/agentworkforce/relaycast-self-host:12.7.0 = sha256:81274dca7ab58673383dc7a9c777f422f29606c7422e81b5ea15724770f1455e

• public; linux/amd64 + linux/arm64 checked anonymously from the registry
• SPDX SBOM, max-mode SLSA provenance, and a GitHub build-provenance attestation

Changes:

• charts/relaycast 0.3.2 (appVersion 12.7.0) defaults to this digest, so the relaycast kind smoke in CI exercises it
• charts/agent-relay 0.3.3 (rebased on the untagged 0.3.2 proof refresh, #39) depends on relaycast 0.3.2 (Chart.lock regenerated), and values-gcp.yaml pins the digest
• customer-images.yaml: relaycast approved; IMG-BLOCK-005 now names only Sessions services
• evidence: chartVersion 0.3.3 and a recomputed manifest hash
• requirements.yaml: relaycast-0.3.1 is marked shipped; relaycast-0.3.2 and agent-relay-0.3.3 are current (the never-tagged agent-relay 0.3.2 row is folded into 0.3.3)
• RELEASE_NOTES / STATUS / supply-chain doc updated

Not done: the new engine (12.2.1 to 12.7.0) has not run the GKE upgrade/restore drills; that is stated in the release notes. After merge, the release lane tags agent-relay-0.3.3 (a new tag; existing tags never move).

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}