[minor] Bundle application releases and harden images

[pennypacker-he]

Summary

• bundle pinned OJS 3.5.0-5, Omeka S 4.2.1, and Omeka Classic 3.2.1 releases into published PHP images with software-version tags
• standardize s6/confd readiness, database bootstrap, credential lifetime, healthchecks, and rendered secret modes across images
• harden ArchivesSpace/ActiveMQ/Drupal/OJS runtime credential handling and special-character behavior
• make Buildkit planning, branch caches, checksum updates, Go tests, and sitectl smoke ordering fail closed

Local validation

• Go tests, actionlint, Bash syntax, bake graph, updater contracts, and staged diff checks
• fresh OJS/Drupal application installs and continuous-confd lifecycle
• ActiveMQ 5/6, Tomcat 9/11, Alpaca, WordPress, and credential-mode runtime checks

Hosted GitHub CI is the authoritative multi-architecture and smoke-test gate. This PR must not merge until its complete branch workflow passes.