ci: pin ci-base to immutable lock-9cb7ffcd8828 (#1328)

Every pipeline step ran from the mutable tag ci-base:latest, which the k8s
backend resolves per-pod at pull time: the same tree and config could execute
different images across runs, and no run recorded which image it ran. That is
the uncontrolled variable left standing after #1324's measurement excluded
agent version and concurrency (all 48 pipelines that day ran on agent 45).

Pin to lock-9cb7ffcd8828, the immutable tag ci-image.yml pushes atomically
with :latest. Byte-identical to what runs today by construction: last ci-image
run was main 712c770 (2026-07-26), main's recipe files unchanged since, no
later rebuild. Zero behavior change at pin time; drift becomes a deliberate,
reviewed commit instead of a race. A wrong or missing tag fails loudly at
image pull, which is the guard enforcing itself.

Bump procedure and known limitations (lock-tag addresses the lockfile only;
recipe changes on next do not rebuild the base until they reach main) are
documented in the ci.yml header comment and issue #1328.

.woodpecker/ci.yml

@@ -21,19 +21,11 @@ variables:
   - &enable_pnpm 'corepack enable'
 
 when:
-  # PR + manual CI run on any branch: the pull_request pipeline is the merge
+  # PR + manual CI run on any branch — the pull_request pipeline is the merge gate.
-  # gate (next is protected and the default branch since 2026-08-19).
+  # push CI is restricted to protected branches (main) so a feature-branch push no
-  # Push CI runs on main only. next deliberately runs NO push ci: post-merge
+  # longer fires a redundant SECOND pipeline alongside its PR pipeline. This ~halves
-  # verification on next is carried by publish.yml's `verify` step
+  # CI load on the storage-constrained runner with zero loss of gating (branch
-  # (pnpm verify:release), which mirrors this pipeline's complete mandatory
+  # protection requires no push/ci status context; main still gets full push CI).
-  # set step-for-step, enforced by scripts/verify-release.test.mjs. PR CI
-  # tests the PR HEAD tree (refs/pull/N/head, measured 2026-08-19), not a
-  # merge ref, so if next advances before a merge the landed tree differs
-  # from the tested one; publish verify re-runs the full set on the landed
-  # tree (PGlite path). Measured 2026-08-19: the 21 most recent push events
-  # on next each ran exactly one pipeline (publish), zero ci.
-  # Keeping push ci off next also avoids a redundant second full-suite run
-  # per merge on the storage-constrained runner.
   - event: [pull_request, manual]
   - event: push
     branch: main