Preflight dependency locks against the exact base image

[shiny-code-bot]

Summary

• resolve the exact immutable base-runtime digest before dependency compatibility validation
• mount staged support and tenant roots read-only into each requested base platform
• mirror strict sync's lock checks and exports, derive constraints from the inherited /venv, and run a dependency-free uv dry-run before Buildx
• fail with a platform-specific diagnostic before artifact image construction starts

Why

OPW's tenant lock was internally current but incompatible with packages already owned by the selected Odoo base image. Artifact publication discovered that only inside the production image build. This probe moves the same base-overlap contract to an explicit pre-Buildx boundary without moving image selection out of Launchplane.

Validation

• uv run python -m unittest discover -s tests (222 passed, 1 skipped)
• uv run ruff check .
• uv run ruff format --check .
• uv build
• uv run platform --help
• real arm64 OPW canary against the rebuilt base image: lock checks and uv dry-run pass
• JetBrains changed-files inspection: green

Refs #87