Make downloaded Docker build dependencies reproducible

[DenWin]

Goal

Ensure Docker builds use authenticated or checksum-verified, explicitly versioned third-party artifacts.

Proposed work

• Add SHA-256 verification for the downloaded Bun archive.
• Add SHA-256 verification for the downloaded VTracer archive.
• Pin the MarkItDown package version instead of installing the latest release.
• Avoid mutable download URLs and implicit latest-version resolution.
• Add a documented dependency-update procedure.
• Configure Renovate updates where supported.
• Fail the build clearly when a checksum or architecture does not match.

Acceptance criteria

Two builds from the same source and base digest resolve the same Bun, VTracer, and MarkItDown versions, and corrupted or substituted downloads fail before installation.