Harden nested and external Docker build supply chain

[tom-sapletta-com]

Context

The PR #62 audit proved the root Koru Docker image is digest-pinned, external
Compose Git contexts are commit-pinned, docker compose --profile '*' config --quiet passes, and docker build --check . reports no warnings.

The bounded audit also found residual mutability inside nested/upstream
Dockerfiles and installers: mutable Python base tags, unconstrained installer
downloads, and dependency resolution not bound to immutable artifacts. This was
an explicit non-goal of ticket 028 and needs its own ownership boundary.

Scope

• Inventory every nested and external Docker build stage consumed by Koru.
• Pin base images by digest and external installers by version plus checksum.
• Replace mutable dependency resolution with lock/hash-bound installation where
  the upstream project supports it.
• Add a deterministic audit that covers nested contexts without broadening
  ticket ownership across repositories.

Acceptance

• No consumed Docker base image or installer is selected by a mutable tag,
  branch, or latest release.
• Compose configuration and Docker build checks remain green.
• Cross-repository changes are delivered by their owning tickets and immutable
  revisions are then adopted by Koru.

Related: #41, PR #62.