Pin Docker publish inputs and remove rolling revalidation

[abmmhasan]

Summary

Fixes the 0.4.1 Docker Publish failure in Revalidate rolling upstreams before publish and makes release builds reproducible against one immutable upstream snapshot captured at workflow start.

Root cause / failure mode

Apache had an extra mutable-upstream revalidation gate that docker-runner does not have. Under set -o pipefail, that step also used early-exit parsing around network-backed commands, so an upstream/network/pipe failure could terminate the publish with an opaque status such as the observed exit 255.

Changes

• remove the redundant pre-publish rolling-upstream revalidation step
• snapshot rolling inputs once with bounded retries and validation
• checksum the Toolset installer from the exact resolved Toolset release
• keep normal/local Docker builds rolling by default
• pin every publish build to the same snapshot:
  • httpd:alpine@<digest>
  • exact Scriptomatic main commit SHA
  • exact latest-stable Toolset release
  • exact Toolset installer SHA-256
• pass those same pinned values to the amd64 candidate, arm64 candidate, and final multi-architecture build
• extend static/release contracts so revalidation cannot be reintroduced and all three publish builds must stay pinned

Recovery

After merge, recover release 0.4.1 through Docker Publish → Run workflow with release_tag=0.4.1. The failed 0.4.1 run stopped before registry login/push, so the immutable 0.4.1 image tag was not consumed.