fix(docker): pin backend runtime base images

[Canvinus]

Summary

• pin Node build base image by digest
• pin Docker-in-Docker runtime base image by digest

Why

PR #7 fixes the stale inner-Docker startup state, but rebuilding from moving tags would also pull newer Node/Docker base images and reinstall current Rust stable/near-cli-rs. During the attempted prod rebuild, that would have upgraded the image to Rust 1.96.1 and near-cli-rs 0.27.0. This follow-up keeps the outage fix isolated to the startup command.

Verification

• docker manifest inspect node@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14
• docker manifest inspect docker@sha256:7d85d0eda291f1a7ab6df4a9d1802b5ad4cf9145a088bd11188c78dcb5c7392b
• sh -n startup command syntax check passed
• git diff --check passed

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f65b590fbb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pin the Rust and near-cli installs too

In the production rebuild scenario this change is meant to make reproducible, starting from a digest here still does not freeze the toolchain installed later: the Dockerfile continues to run rustup with --default-toolchain stable and cargo install near-cli-rs without a --version, so a rebuild will still pick up current Rust and near-cli-rs even though the base image is pinned. Please pin those versions as well if the outage fix needs to stay isolated to the startup command.

Useful? React with 👍 / 👎.