chore(build): digest-pin base images + SHA-pin workflow actions (#4203)

[wrkode]

What

Supply-chain hardening: make the image build and CI reproducible and
tamper-evident by content-addressing every external dependency.

Closes kairos-io/kairos#4203.

How

• Dockerfile + Makefile — digest-pin all base images as
  image:tag@sha256:<digest> (tag kept for readability): hadron, kairos-init,
  golang (static + alpine builders), and alpine. The pinned digest is the
  multi-arch index digest, so cross-arch builds still resolve the correct
  per-platform manifest. KAIROS_BASE_IMAGE/KAIROS_INIT_IMAGE are pinned in
  both the Dockerfile ARG defaults and the Makefile defaults, since CI's
  make image passes the Makefile value (this closes the override path).
• ci.yml + release.yml — SHA-pin the remaining GitHub Actions (checkout,
  setup-go, setup-buildx-action, login-action, golangci-lint-action) with a
  # vN comment, matching the already-pinned attest/sbom actions. No floating
  action tags remain.
• make verify-pins (wired into the CI gates job) — fails loud if a
  base-image digest drifts between the Dockerfile and the Makefile, or is not
  digest-pinned, so a two-site re-pin mistake cannot land silently.

Validation

• make verify-pins passes (and was negative-tested: it fails on injected drift).
• make image (cached) builds green with the digest pins; workflow YAML parses;
  go build/test/vet/lint all green.
• Confirmed no make image/make e2e-node-image invocation in CI/release passes a
  floating KAIROS_*_IMAGE override; the e2e-node BASE_IMAGE is our own built
  image (nothing external).

Security review

security-architect reviewed and passed the gate (no blockers): index-vs-arch
digest choice is correct, the Makefile/Dockerfile override path is closed, and
action SHA-pinning is now 100%. Known, tracked residuals (explicitly out of scope
for #4203, called out so reviewers don't re-flag them):

• The crane binary download stays version-tag + sha256-checksum-verified
  (the same integrity model as the kubeadm/kubectl/crictl/runc/CNI downloads).
• Digest-pinning the control-plane image crane pull in the image-bundler is
  the deferred ADR-16 P5 item (it needs per-image digest resolution from
  kubeadm config images list) and remains the last tracked floating external ref
  in the build.

[wrkode]

LGTM