ci: verify the production container image

[szweibel]

Turns the existing source gate into a real artifact gate without adding a duplicate build interface.

The patch:

• replaces the mutable veraPDF download/path mismatch with the exact official 1.28.2 archive and detached signature
• imports the official key and requires the documented fingerprint
• derives the installer path from the same pinned version
• builds the actual Docker image after the existing source check
• starts it with dummy configuration and verifies the credential-free health endpoint

Validation:

• independent review approved
• 527 backend tests, ESLint, TypeScript, and Vite build pass
• clean host and linux/amd64 Docker builds pass
• installed veraPDF reports 1.28.2
• runtime health smoke passes and cleanup removes the container
• no secrets, registry login/push, deploy, or new actions

Base images and apt feeds remain existing mutable inputs; this is a truthful artifact build gate, not a bit-for-bit reproducibility claim.