INFD-WP-0010-T02: owner-CI workflow for the full service image

.forgejo/workflows/service-image.yaml builds Containerfile from the pushed
commit's tarball and pushes forgejo.coulomb.social/coulomb/informed-decision
:main-<short sha>, then reports the immutable digest. Before pushing it
checks the zlib floor, the runtime smoke (tools/zlib_overlay/check_runtime.py)
and that the installed modules equal the commit's source.

Containerfile builds the wheel in-image (hash-pinned setuptools in
requirements-build.lock) and installs the zlib overlay's hash-pinned,
Alpine-signed zlib-1.3.2-r1 package offline, failing below 1.3.2-r1, so the
live image's zlib fix cannot regress. Overlay workflows are unchanged.
Local build: 13/13 container checks, zlib 1.3.2-r1, source manifest match.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

tools/service_image/installed_manifest.py

@@ -0,0 +1,13 @@
+"""Print `sha256  ./relative/path` for the installed informed_decision modules (C-sorted).
+
+Run inside the service image (`docker run -i --entrypoint python IMAGE - < this file`). CI compares
+the output with `sha256sum` over the pushed commit's informed_decision/*.py: the image must carry
+exactly the source it was built from. Opens no database and no network.
+"""
+import hashlib
+from pathlib import Path
+
+ROOT = Path('/opt/venv/lib/python3.12/site-packages/informed_decision')
+rows = sorted('./' + str(p.relative_to(ROOT)) for p in ROOT.rglob('*.py') if '__pycache__' not in p.parts)
+for rel in rows:
+    print(hashlib.sha256((ROOT / rel).read_bytes()).hexdigest() + '  ' + rel)