feat(linux): provide pinned gh-stack tooling - #30

Summary

• replace Ubuntu's distro gh package in the broad Linux image with the official checksum-pinned GitHub CLI 2.97.0 archive and MIT license
• install checksum-pinned github/gh-stack v0.1.0 for the non-root ubuntu user, retaining its pinned manifest, source/license evidence, and ordinary extension dispatch
• validate exact non-root versions, manifest pin state, discovery, help, checksum, whole-image SPDX inventory, and signed release provenance without putting credentials into the build or review-built container
• document the installed contract and reproducible smoke commands

Closes #29.

Coordinates

• Base: main at cfd1afd4088f76f6cd327159b0d58b20a6a6b0dd
• Head: feat/pinned-gh-stack at f96fdade70435ba9826099552a09f0909db327ba
• Worktree: /workspaces/atrinik/workspace/worktrees/devcontainer/issue-29-gh-stack
• Commits: 7721ece feat(linux): provide pinned gh-stack tooling; f96fdad fix(linux): harden gh-stack verification

Validation

• docker build --check --file linux/Dockerfile .
• docker build --check --file windows/Dockerfile .
• docker build --file linux/Dockerfile --target validation --tag atrinik-linux-validation:issue-29 .
• non-root gh 2.97.0, Git 2.53.0, owner/name/tag/ispinned: true, extension-list, gh stack --version, gh stack --help, SHA-256, and installer cache/state absence assertions
• trusted-host gh attestation verify uses a checksum-pinned GitHub CLI and is constrained to github/gh-stack, .github/workflows/release.yml, refs/tags/v0.1.0, source/signer commit a1b4a3d4d0bcde9ec3a78ab99b2d63af121857a9, and the expected linux-amd64 digest
• validation generates SPDX 2.3 for the whole image and asserts GitHub CLI 2.97.0, gh-stack v0.1.0, and the exact nested audio inventory
• actionlint -config-file .github/actionlint.yaml .github/workflows/*.yml
• tools/test-require-image-checks.sh
• tools/validate-toolchains.sh toolchains.json '' audio-toolchain.json '' audio-toolchain.spdx.json '' windows/classic-check-toolchain.json
• git diff --check

Manual verification

Runtime topology is not applicable: this repository publishes build images and the change does not alter an Atrinik game service. Build and inspect the broad Linux image directly:

docker build --file linux/Dockerfile --tag atrinik-linux-build .
docker run --rm --user ubuntu --env HOME=/home/ubuntu \
  atrinik-linux-build gh version
docker run --rm --user ubuntu --env HOME=/home/ubuntu \
  --env GH_TOKEN=unused atrinik-linux-build gh extension list
docker run --rm --user ubuntu --env HOME=/home/ubuntu \
  atrinik-linux-build gh stack --version
docker run --rm --user ubuntu --env HOME=/home/ubuntu \
  atrinik-linux-build gh stack --help
docker run --rm --user ubuntu --env HOME=/home/ubuntu \
  atrinik-linux-build sha256sum \
  /home/ubuntu/.local/share/gh/extensions/gh-stack/gh-stack
docker run --rm atrinik-linux-build \
  syft dir:/ --select-catalogers +sbom-cataloger -o spdx-json

The non-secret GH_TOKEN=unused placeholder suppresses GitHub CLI's login prerequisite for the local-only extension-list query; no credential is needed. No command creates, changes, pushes, links, rebases, unstacks, or merges a stack. Repeating the build and read-only smoke commands is safe. The disposable containers remove themselves; no wrapper profile, scenario, state, topology, server/client data, or cleanup operation is involved.