Replace the packer-images almalinux base with a Dockerfile matrix over distros/,
publishing one image per distro to docker-internal on a single repo semver.
- bootstrap the internal CA from a sha256-pinned rpm fetched over plain HTTP
- install the estate dnf repo configuration pointed at artifactapi
- run in-image assertions as a --target test build stage
- add pull_request build/test/pre-commit and tag-triggered docker workflows
unkin-agent