feat(images): build on rootless BuildKit over mTLS; verification moves into Containerfile verify stages

Operator decision on PR #81: no CI job may reach a privileged daemon. The act runner is untouched.

- platform/buildkit (+ clusters/base/buildkit.yaml): moby/buildkit v0.34.1-rootless pinned by
  digest, uid 1000, not privileged; caps drop ALL + SETUID/SETGID, seccomp/AppArmor Unconfined,
  read-only rootfs (each measured under podman). cert-manager CA + server/client certs, ClusterIP
  :1234, default-deny with ingress only from the act-runner pod (DinD masquerades jobs to it).
  No Kyverno exception: every applied policy matches app-namespace=true only.
- Each Containerfile names its shipped stage and ends in a `verify` stage holding every former
  `docker run` assertion (uid 65532, RUN --network=none, writable-path inventory standing in for
  the read-only rootfs). The old `&& echo` checks that could never fail are real assertions now.
- images.sh drives buildkitd with a pinned buildx (sha256-checked) via bake; PRs build verify
  targets with agent-runner FROM the in-run toolbox (target: context); main verifies, then pushes.
  Fails loudly when the builder secrets are absent or buildkitd is unreachable.
- infra/gitea/buildkit-client-secret.sh copies the client cert into Actions secrets.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/pm-agent-issue-to-pr.md

@@ -245,8 +245,8 @@ about runtime behaviour in this document is a design claim, not a measurement.
    the credential decision now being local Gitea accounts with PATs, that means a
    `dockerconfigjson` for an account whose token carries `read:package`. Only then does the
    digest matter. **Superseded 2026-10-29:** the build-and-push is no longer an operator step.
-   `.gitea/workflows/images.yaml` builds and verifies the image with
-   `infra/agent/build-image.sh`, publishes it on a push to `main`, and Renovate opens the one
+   `.gitea/workflows/images.yaml` builds and verifies the image on rootless BuildKit
+   (`platform/buildkit/`), publishes it on a push to `main`, and Renovate opens the one
    PR that replaces both placeholder digests (`decisions/2026-10-29-image-pipeline.md`). The
    same two blockers sit in front of `conformance-runner`, which shares the registry path and
    has never been pulled.