Release pinned-upstream prebuilt rebuild support

[joecklau]

Summary

Promote develop to main with #46 (commit ffdb73e), adding the explicit rebuild_source_digest dispatch input for Docker Sandboxes prebuilt images.

The workflow reuses the exact source index and both platform digests from a signature-verified active EPAR package, retaining historical upstream evidence without changing timestamps or catalog schema. Still-fresh evidence permits normal compatible promotion; evidence older than ten days remains candidate-only. Default upstream gating is unchanged.

Validation

• Full Go regression suite passed.
• Final uncached publisher/prebuilt tests and focused race tests passed.
• YAML and all 33 embedded Bash steps passed syntax checks.
• Independent review passed with no release-blocking findings.
• Live signed Full catalog/package verification and production-identity source-selection/descriptor verification passed.

After merge

Dispatch docker-sandboxes-images.yml on main with profile=full, rebuild_source_digest=sha256:5e2f9190fe54b99fb1032a8506a6a651f80b2fccb1f5136eb31ec28659e5fd44, force_candidate=false, and promote_candidate=false. Verify that hosted platform builds actually begin. Published-image runtime verification remains a subsequent step.

The repository owner explicitly requested admin/bypass merge for this release.