chore(toolchain): resolve pinned build-toolchain image digest drift

[AdamMagued]

Summary

Re-resolves pinned build-toolchain image digests across operator manifests, runtime definitions, and freshness inventory per ADR060 D7.

Fixes #86

Changes

• Pinned build-toolchain image digests updated:
  • cnb-builder to sha256:36c91de1fd14a3f4e5434659c4a8d9f8f379f46408117234b0c77b3f7e35d078 across lego/operator/cmd/manager/main.go, lego/operator/config/manager/manager.yaml, and deploy/gitops/charts/kpack/platform.yaml.
  • cnb-stack-build to sha256:bea90980583a314c499cb747596c22b42217c81c6efc8d38ac5561a2cbad70b1 in deploy/gitops/charts/kpack/platform.yaml.
  • cnb-stack-run to sha256:b795be25d01ec25cc9f8aa6980ad98d9a2c09f2caea24aef5c9a26c16f674356 in deploy/cnb-run/Dockerfile.
  • cnb-run-image to sha256:e737036058ca4fb01ac1fbc344a8d56ea926f9ed77bef471c4d796830b589fe6 in deploy/gitops/charts/kpack/platform.yaml.
  • native-busybox to sha256:bdf57e528e45e4433820e045b29b4597825a1c9e38353532d90a01445013f82e in lego/operator/internal/build/native.go.
  • native-elixir lines (1.17, 1.18, 1.19) to observed digests in lego/operator/internal/build/native.go.
  • native-node lines (22, 24, 26) to observed digests in lego/operator/internal/build/native.go, setting Node 26 line version to 26.11.1 matching image configuration.
  • native-python lines (3.10, 3.11, 3.12, 3.13, 3.14) to observed digests in lego/operator/internal/build/native.go, setting Python 3.13 line version to 3.13.16 matching image configuration, and updating test fixture base in lego/operator/cmd/native-resolve/main_test.go.
  • native-ruby lines (3.3, 3.4, 4.0) to observed digests in lego/operator/internal/build/native.go.
  • native-rust to sha256:114c7a4425406451c2866b6aafe69fe29b1b298832db1277d411ac73c82d04d6 in lego/operator/internal/build/native.go.
• Freshness inventory (lego/operator/internal/build/toolchain-freshness.json) updated with matching digests and review timestamp 2026-10-11T02:05:00Z.

Verification

• python3 scripts/lib/toolchain-freshness.py validate passes.
• bash scripts/build-toolchain-freshness.test.sh passes.
• bash scripts/image-pin-validate.sh passes (104 references verified).
• python3 scripts/lib/toolchain-freshness.py resolve confirms zero drift across all 25 images.
• EXISTING_ISSUE=86 python3 scripts/lib/toolchain-freshness.py issue-action evaluates to close.