ci: harden runtime image contract

[Serph91P]

Summary

• add a precise Docker build-context contract and pinned Node, npm, and Python toolchains
• install checksum-verified Rclone v1.72.1 for amd64 and arm64
• make nginx-backed health, proxied API, and advertised runtime binary checks block CI
• restore the release build to both advertised architectures with QEMU support

Verification

• Node 24.11.1 and npm 11.6.2: npm ci, 60 frontend tests, ESLint, TypeScript, production build
• Python 3.14.6: 103 backend tests, Ruff check, Ruff format check
• docker build -t dockervault:ci-contract .
• live nginx /health, direct backend /health, proxied /api/v1/auth/status, Docker health status
• runtime checks for rclone, rsync, ssh, sftp, sshpass, age, and curl
• actionlint for changed workflows
• git diff --check and Unicode dash scan

Notes

• Existing mypy errors remain explicitly non-blocking.
• Existing vulnerability scans remain non-blocking via step policy, without shell fallbacks.
• Restic is not included.

Fixes #135