Every pipeline step ran from the mutable tag ci-base:latest, which the k8s
backend resolves per-pod at pull time: the same tree and config could execute
different images across runs, and no run recorded which image it ran. That is
the uncontrolled variable left standing after #1324's measurement excluded
agent version and concurrency (all 48 pipelines that day ran on agent 45).
Pin to lock-9cb7ffcd8828, the immutable tag ci-image.yml pushes atomically
with :latest. Byte-identical to what runs today by construction: last ci-image
run was main 712c770 (2026-07-26), main's recipe files unchanged since, no
later rebuild. Zero behavior change at pin time; drift becomes a deliberate,
reviewed commit instead of a race. A wrong or missing tag fails loudly at
image pull, which is the guard enforcing itself.
Bump procedure and known limitations (lock-tag addresses the lockfile only;
recipe changes on next do not rebuild the base until they reach main) are
documented in the ci.yml header comment and issue #1328.
ops-ci-01