Build sealed tuna-flow v2.7 runtime

[kyuhank]

Summary

• Publish the private tuna-flow-private:v2.7 runtime while leaving public tuna-flow:v2.5 and v2.6 unchanged.
• Pin the exact v2.5 MFCL executable and all workflow packages to immutable commits.
• Install private packages only at build time via a BuildKit secret; remove runtime package installation.
• Verify the executable checksum and bundled package set during the Docker build and again by starting the completed image in GitHub Actions.

Validation

• docker build --check tuna-flow
• shell, R, YAML, and whitespace checks

A workflow-dispatch build with version 2.7 will verify the private image before this is merged.