Allow prebuilt rebuilds from verified pinned upstream sources

[joecklau]

Summary

Add an explicit workflow_dispatch rebuild_source_digest input identifying the current active EPAR package whose signed source and historical upstream evidence should be reused. This allows EPAR recipe fixes to build without depending on the newest Catthehacker workflow run.

• Verify the signed active catalog/package, exact profile, source index, and both platform descriptors; reject missing, revoked, mismatched, or ambiguous baselines.
• Carry the immutable source through build, provenance, planning, and promotion; retain catalog/alias CAS and promotion-time authorization checks.
• Preserve honest upstream timestamps and catalog schema 2. Evidence older than ten days allows candidate-only publication, not automatic stable advancement. Normal dispatch/schedule/push behavior remains unchanged.

Validation

• Full Go suite passed.
• Final uncached publisher/prebuilt tests and focused race tests passed.
• YAML parsed; all 33 Bash workflow bodies passed syntax checks; git diff --check passed.
• Independent review: no release-blocking findings; reviewed diff SHA-256 5fe5fbb9e2bdde7463812adf9fe234646bb3a47ef91eb1208bfa8bed135e186d.
• Live read-only signed Full catalog/package verification and new source-selection/descriptor commands passed with the real active package and distinct source/platform digests.
• Actual hosted build remains pending the main merge and explicit Full dispatch.

Checklist

• No credentials, private keys, tokens, or machine-specific configuration committed.
• Tests and operational documentation updated.
• Existing catalog/consumer compatibility and default publication behavior preserved.

Admin merge requested by the repository owner. Follow with develop-to-main PR and an explicit Full pinned-source build.