Add matrixed container base image build

Replace the packer-images almalinux base with a Dockerfile matrix over distros/,
publishing one image per distro to docker-internal on a single repo semver.

- bootstrap the internal CA from a sha256-pinned rpm fetched over plain HTTP
- install the estate dnf repo configuration pointed at artifactapi
- run in-image assertions as a --target test build stage
- add pull_request build/test/pre-commit and tag-triggered docker workflows

pre-commit.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Guards the one mistake this layout invites: a distro added under distros/ but left
+# out of a .woodpecker matrix, so it silently never gets built.
+set -uo pipefail
+
+REQUIRED_KEYS="BASE_IMAGE IMAGE CA_RPM_URL CA_RPM_SHA256 PACKAGES"
+WORKFLOWS=".woodpecker/build.yaml .woodpecker/test.yaml .woodpecker/docker.yaml"
+
+fail=0
+for d in distros/*/; do
+  n=${d#distros/}; n=${n%/}
+  for k in $REQUIRED_KEYS; do
+    grep -q "^${k}=" "${d}distro.env" || { echo "${d}distro.env: missing ${k}"; fail=1; }
+  done
+  for wf in $WORKFLOWS; do
+    grep -q "DISTRO: ${n}\$" "$wf" || { echo "${wf}: distro ${n} missing from matrix"; fail=1; }
+  done
+done
+
+for s in ./*.sh; do bash -n "$s" || fail=1; done
+
+[ "$fail" -eq 0 ] || { echo "FAILED"; exit 1; }
+echo "PASS"