[kwsantiago]

Makes the release tarballs reproducible by anyone from the tag, and splits the checksum manifest so a signer signs only what they rebuilt.

• Builder images pin pyenv by commit and check uv, Rust, protoc and lowdown against pinned sha256 hashes. Rust now comes from its standalone installer instead of rustup; its hashes match its signed channel manifest. The other hashes only detect a change since pinning. The armv7 rust-std download is pinned the same way.
• The release workflow writes SHA256SUMS-<version> for amd64 and SHA256SUMS-<version>-arm64 for arm64.
• contrib/cl-repro.sh refuses to run outside the repository root, stops on the first error, works with rootless Docker (ROOTLESS=1), builds the arm64 images on an amd64 host under emulation (PLATFORM=linux/arm64), and passes debootstrap the Ubuntu archive keyring explicitly, as the workflow now does.
• The README states that a manifest is only signed by someone who rebuilt every tarball it lists, and documents how to rebuild a release.

Tested: with these images, all six tarballs of v26.06.9-blake2b.8 and of v26.06.9-blake2b.9 (Ubuntu 22.04, 24.04 and 26.04, amd64 and arm64) rebuild bit for bit against their published manifests, on rootless Docker with arm64 under qemu. cl-repro.sh run end to end, with and without PLATFORM=linux/arm64, produced images whose 24.04 tarballs matched. shellcheck and actionlint are clean. The armv7 path is not exercised, since armv7 tarballs are not released.

Changelog-None