Fix GHCR attestation example by listing GHCR first in metadata images

[LindonAliu]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/actions/tutorials/publish-packages/publish-docker-images

What part(s) of the article would you like to see updated?

https://docs.github.com/en/actions/tutorials/publish-packages/publish-docker-images#publishing-images-to-docker-hub-and-github-packages

Why should the docs be changed? What use cases does it support?

The current order can cause the attestation to fetch a Docker Hub digest from GHCR, which returns 404. This affects users who push to multiple registries but attest only GHCR. The change prevents false failures and supports secure supply-chain workflows (SLSA-style provenance, compliance, CI reliability).

Reference failing run (context):
https://github.com/glu-lang/glu/actions/runs/17557475866/job/49865233829

Additional information

No response

[welcome]

Thanks for opening this issue. A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.