fix(devcontainer-base): validate base updates before publishing

[robarnold]

Summary

• revert the devcontainer base from Fedora 45 to Fedora 44
• make every regular CI job build and load the checked-out devcontainer base locally
• preserve the existing build, check-format, lint, and kustomization-test check contexts
• preserve devcontainer registry cache export through Docker's containerd image store
• validate base-image updates through the full downstream pipeline before publishing
• publish the exact tested candidate as latest only after validation succeeds
• keep pull-request builds non-publishing and serialize base-image builds for the same ref

Root cause

The Fedora 45 update moved the devcontainer to Python 3.15. aiohttp did not provide a CPython 3.15 wheel, so the devcontainer build fell back to a source build and failed because no compiler was installed.

The base-image workflow previously published latest as soon as the base itself built. Its pull-request run did not exercise the downstream devcontainer, so the incompatible image reached latest despite green PR checks.

CI behavior

Regular CI assigns the checked-out base a commit-specific tag, builds and loads it on each isolated runner, and passes that tag into the devcontainer build. The required checks therefore validate repository source rather than depending on the already-published latest.

The regular build job enables Docker's containerd image store. That keeps the default daemon-backed builder able to consume the locally loaded candidate while also exporting the shared devcontainer registry cache.

The base-image workflow separately builds one candidate, runs check-format, lint, and the complete kustomization test suite against it, then retags and pushes that exact local image on main and scheduled runs. Pull-request runs never publish.

Validation

• formatted .github/workflows/checks.yml with the repository's Prettier version
• parsed the workflow with yq
• passed git diff --check
• verified all four job definitions build a local base and still invoke devcontainers/ci
• verified the regular build log contains both the commit-specific DEVCONTAINER_BASE_TAG and --cache-to ghcr.io/marinatedconcrete/config-devcontainer
• all nine regular checks passed: build, formatting, lint, and all six kustomization tests
• candidate-image validation passed the full downstream pipeline; the PR publish step was skipped