ci: conformance suite with Garage S3 image cache (7lf)

Two new srht.bigb.es manifests:

  .builds/conformance.yml — auto-submits on push to master/tags. Pulls
  the conformance Docker image from s3://docker-cache/ keyed by
  sha256(docker/conformance.Dockerfile); on cache miss, builds it and
  uploads. Runs both 'just conformance' and the C-runtime variant
  against the cached image.

  .builds/conformance-image-rebuild.yml — manual-submit only
  (allow-refs: []). Force-rebuilds with --no-cache --pull and replaces
  the S3 object. Use when the cached image needs refresh without a
  Dockerfile change (base-image CVE, host docker upgrade, corrupted
  upload).

Garage S3 specifics:
  - addressing_style = path (Garage doesn't do virtual-host)
  - signature_version = s3v4 (Garage rejects SigV2)
  - region = garage (matches phoebe-lab/garage/config/garage.toml.tmpl)
  - head-object for cache-hit check (s3 ls returns exit 0 on missing
    keys; head-object 404s cleanly)
  - Endpoint https://s3.bigb.es works from the build worker because
    srht-build-1 (192.168.88.128) is in Authelia's *.bigb.es LAN-bypass
    range (192.168.88.0/24)

Credentials come from two file secrets registered at
https://builds.srht.bigb.es/secrets, mounted as ~/.s3-cache-key-id and
~/.s3-cache-key-secret. Loaded under 'set +x' and persisted to
~/.buildenv via printf %q so subsequent tasks pick them up without
re-tracing.

The bucket 'docker-cache' and its bound key must exist on Garage with
read+write permission for the supplied access key — first push will
fail at the smoke-test 'aws s3 ls' line otherwise. (7lf)