fix(ci): restore exact AI release evidence gates

.github/workflows/release-gates.yml

@@ -133,6 +133,9 @@ jobs:
       - name: Generate SPDX SBOM
         env:
           RELEASE_SHA: ${{ github.sha }}
+          GEOINTEL_IMAGE_ARCHIVE: artifacts/geointel-image.tar
+          GEOINTEL_KEEP_IMAGE_ARCHIVE: "true"
+          SYFT_PARALLELISM: "1"
         run: |
           IMAGE_ID="$(cat artifacts/image-id.txt)"
           test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
@@ -140,11 +143,19 @@ jobs:
       - name: Enforce container vulnerability policy
         env:
           RELEASE_SHA: ${{ github.sha }}
+          GEOINTEL_IMAGE_ARCHIVE: artifacts/geointel-image.tar
+          GEOINTEL_KEEP_IMAGE_ARCHIVE: "true"
         run: |
           IMAGE_ID="$(cat artifacts/image-id.txt)"
           test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
           bash scripts/scan_container_image.sh "$IMAGE_ID"
           test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
+      - name: Remove temporary image archive
+        if: always()
+        run: >-
+          rm -f -- artifacts/geointel-image.tar
+          artifacts/geointel-image.tar.image-id
+          artifacts/geointel-image.tar.partial.*
       - name: Publish container evidence
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2