CAIN-42 reproducible build check

Two independent builds of the same git commit, each from a clean `git archive`, with --no-cache,
SOURCE_DATE_EPOCH = the commit time, BuildKit rewrite-timestamp, no provenance/SBOM attestations,
the base image pinned by digest and every Python package pinned (--no-deps), produced the SAME image ID.
See REPRODUCIBLE_BUILD.json (image IDs, build times, identical_filesystem_layers).

Rebuild it yourself (needs the source, which is not public; the commit hash is the commitment):
  git archive <commit> | tar -x -C ctx && cd ctx
  docker buildx build --no-cache --provenance=false --sbom=false \
    --build-arg SOURCE_DATE_EPOCH=$(git log -1 --format=%ct <commit>) \
    --output type=image,name=check,rewrite-timestamp=true,unpack=false -f Dockerfile.cluster-node .
  docker image inspect -f '{{.Id}}' check      # compare with the image_id in REPRODUCIBLE_BUILD.json

Not claimed: reproducibility on another day or machine (Debian packages are installed from the live apt
index, not a pinned snapshot); an independent rebuilder has not reproduced it yet.