Add content-addressed runtime build API

[miki3421]

What changed

• add authenticated builder capability, ensure, and status endpoints
• derive build identity from the allowlisted builder contract and dependency file
• derive target repositories from the authenticated namespace
• create deterministic asynchronous BuildKit Jobs and report stable states
• separate registry push and pull endpoints
• validate namespaces, source images, target images, and ConfigMap-sized build inputs
• prevent user environment values from overriding cluster-managed registry settings
• preserve the existing alpha build endpoints

Why

ops ide deploy needs a safe server-side mechanism to build a custom runtime without accepting arbitrary Dockerfiles, source images, registry destinations, or target namespaces from a client.

Impact

Equivalent dependency inputs reuse a completed build. Failed builds can be retried after deterministic cleanup. Returned action image references use the node-reachable pull endpoint while BuildKit pushes through the in-cluster Service.

This draft is coordinated with changes in openserverless-task, openserverless-operator, openserverless-runtimes, and openserverless-testing.

Validation

• full Python unit test suite: 39 passing tests
• local ARM64 image build
• end-to-end BuildKit Jobs on Kind and K3s
• dependency installation, registry push, action pull, invocation, and cached redeploy verified
• git diff --check