Harden Apache runtime, CI and release pipeline

[abmmhasan]

Summary

Hardens docker-apache as a predictable LocalDevStack Apache backend while preserving the rolling httpd:alpine base and the existing Nginx -> Apache architecture.

What changed

• remove the redundant apache-mod-fcgid / Alpine Apache server path and keep mod_proxy_fcgi for PHP-FPM
• intentionally retain apache2-utils (ab, htpasswd) without installing Alpine's apache2 server package
• make SERVER_NAME and APACHE_LOG_DIR real runtime contracts
• harden and make Apache configuration mutation idempotent/non-destructive
• add the small global Apache hardening baseline (ServerTokens, ServerSignature, TraceEnable, ProxyRequests)
• improve entrypoint and healthcheck diagnostics
• bound Scriptomatic/Toolset downloads with retries, connect timeout, and total timeout
• migrate Scriptomatic to main and Toolset to the stable installer
• add permanent static/runtime CI, BuildKit validation, ShellCheck, actionlint, package inventory and Trivy
• cover amd64 + arm64, PHP-FPM TCP + Unix socket forms, read-only mounts, and real Nginx -> Apache backend mTLS
• modernize Docker Hub + GHCR publishing with immutable release tags, latest-only refreshes, multi-arch images, provenance, SBOM, attestations and digest verification
• reconcile README/runtime documentation with the actual published infocyph/apache contract

Validation

Latest branch CI run is green on 763928f2fe99db004f9573fc5c160e0282713375:

• static + contract checks ✅
• ShellCheck + actionlint ✅
• BuildKit validation ✅
• amd64 build + full release gate ✅
• arm64 build + startup smoke ✅
• Apache config/module/idempotency contracts ✅
• PHP-FPM TCP + Unix socket fixtures ✅
• health/runtime env/read-only mount checks ✅
• Nginx -> Apache backend mTLS ✅
• package inventory (apache2-utils present; apache2 / apache-mod-fcgid absent) ✅
• Trivy HIGH/CRITICAL scan ✅

This PR is intentionally draft pending final review/merge decision.