Harden Docker build supply chain for external consumers

[tom-sapletta-com]

Context

Koru issue semcod/koru#64 consumes TestQL as a commit-pinned Git Docker context, but TestQL Dockerfile still selects a mutable Python tag and resolves its package dependencies without a committed lock.

Scope

• Assign a portable Python lockfile to the integration workstream.
• Generate the lock without repository-local source overrides.
• Pin every Docker base/tool stage by sha256 digest.
• Install from the committed lock in frozen/no-sources mode.

Acceptance

• No consumed image stage is selected by a mutable tag.
• Docker installation cannot resolve or rewrite dependencies.
• Governance, Compose, Docker build/runtime and package tests pass.
• The merged immutable revision can be adopted by Harden nested and external Docker build supply chain semcod/koru#64.