INFD-WP-0010-T02: owner-CI workflow for the full service image

.forgejo/workflows/service-image.yaml builds Containerfile from the pushed
commit's tarball and pushes forgejo.coulomb.social/coulomb/informed-decision
:main-<short sha>, then reports the immutable digest. Before pushing it
checks the zlib floor, the runtime smoke (tools/zlib_overlay/check_runtime.py)
and that the installed modules equal the commit's source.

Containerfile builds the wheel in-image (hash-pinned setuptools in
requirements-build.lock) and installs the zlib overlay's hash-pinned,
Alpine-signed zlib-1.3.2-r1 package offline, failing below 1.3.2-r1, so the
live image's zlib fix cannot regress. Overlay workflows are unchanged.
Local build: 13/13 container checks, zlib 1.3.2-r1, source manifest match.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

workplans/INFD-WP-0010-present-existing-and-proportionate-decisions.md

@@ -107,6 +107,10 @@ revision 13: `deploy/lifecycle/RELEASE-INFD-WP-0010-T02.md`. Tests: 704 passed,
 workflows exist; purpose-overlay run 5 failed by design on the changed `policy.py` hash. The image pin is therefore
 still the live `f5588f49…`, and the candidate must not be synced until the pin is replaced by an owner-CI full image
 that keeps zlib ≥ 1.3.2-r1. Nothing applied.
+Same day, step 0 in source: `.forgejo/workflows/service-image.yaml` builds the full image from the pushed commit and
+publishes `main-<short sha>`. The `Containerfile` builds the wheel in-image and installs the overlay's hash-pinned
+zlib-1.3.2-r1 offline, failing the build below 1.3.2-r1. A local build passed 13/13 container checks. The image pin
+waits for the digest from CI.
 
 Then here: the policy pin, a registry row, a release, and a native proof with synthetic BEA content. Optional: for
 `bounded-execution`, require a packet item whose digest equals `target.admission_digest`, once the admission