Release stellar-cli 28.0.0

[github-actions]

What

Stage a new release for stellar-cli 28.0.0. builds.json is updated with the rust base pins auto-picked from the current last two minor stable releases on rust-lang/rust; each pin resolves the upstream base image digest at append time (<label>@sha256:<digest>).

Why

Triggered by @fnando in https://github.com/stellar/stellar-cli-docker/actions/runs/33005813427.

What is next

See RELEASE.md for the full release process.

Push any further changes to the release/v28.0.0-0 branch that are needed in this release (for example, adjusting the paired rust_versions if the auto-pick isn't right for this iteration).

When this PR is reviewed and merged, create a GitHub Release by going to:

https://github.com/stellar/stellar-cli-docker/releases/new?tag=v28.0.0-0&title=28.0.0-0&target=main

The publish workflow fires on the release-published event and:

• Builds and pushes per-arch images for every declared (cli, rust base) pair; tags are mutable, so an existing tag is overwritten in place
• Generates SLSA build provenance + SPDX SBOM attestations on each built image (buildx-native + GitHub-native chains)
• Re-points the :28.0.0 and (if newest) :latest aliases, and mints the immutable :28.0.0-rust<key>-<arch>-N per-arch snapshots for this iteration
• Attaches the SBOM and provenance files to the new GitHub Release, with per-arch digests in the body

[Copilot]

Pull request overview

Stages stellar-cli 28.0.0 for the Docker image release pipeline.

Changes:

• Adds the pinned upstream stellar-cli commit.
• Adds Rust 1.97.1 and 1.98.0 base-image digest pairings.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.