perf(linux): publish slim Classic CI image - #28

Closes #24.

Scope

• add an amd64-only classic-final Linux target with exact Ubuntu snapshot/package locks, a non-root ccache contract, pinned Classic validation, codec smoke coverage, and nested SPDX validation
• publish classic-build stable/platform/SHA/version tags with provenance and SBOM, plus an isolated candidate_only pre-merge tag that cannot move release aliases
• preserve the current general and task-focused Windows image contracts while combining all four variants under the stable Required checks gate
• keep pull-request validation private-package-free and fail closed on missing/malformed selectors or any selected/unselected job mismatch
• document local and hosted size, pull, startup, job-time, and compiler-cache evidence

Immutable coordinates

• base: main at 38658e57b2c23b2dcf740cf8c1f1df0e017e0144
• head: 332fa210bb438c29bdfa916120b8092080aa5168
• candidate publication: run 31427897129
• candidate index: sha256:e117b858d5aecdb8eb39dc56451378b6e6bd72dd5e042ab96fee5b6154000043
• amd64 manifest: sha256:cdba4bfd40f288e577842b3308e88ccfb7252623ac7b13d08074fc45cc305b8e
• linked consumer: atrinik/classic#98
• read-only package governance: atrinik/github-settings#59

Validation

• Docker --check for both Dockerfiles, actionlint, ShellCheck, Bash syntax, JSON and combined toolchain inventory validation, helper regression tests, and git diff --check
• full Linux Classic validation image plus final image against pinned Classic client/server configure-build-test-coverage workloads as the runner UID
• candidate consumer cold and warm hosted runs, including successful rerun of the transient server timeout
• three independent whole-diff exit reviews on the final head
• latest-head PR workflows and stable Required checks aggregate

Hosted evidence

The durable raw ledger is classic-benchmark.md. On the same GitHub-hosted runner image, warm candidate jobs improved over the apt-based sample by 59.2% for core (206 s to 84 s), 52.4% for client (84 s to 40 s), and 30.2% for server (202 s to 141 s). The amd64 registry layers total 401,282,166 B. Immediate repeated pulls with local layers took 210 ms and 176 ms. Warm runners restored 1,276 direct ccache hits with zero misses across the three isolated component caches.

The candidate digest is review evidence, not the final consumer coordinate. After this PR is merged and semantic-release publishes the versioned image, the Classic consumer must verify the released inventories and source inputs, pin the released digest, and pass Check again before becoming ready.