fix: pin fallback runtime source

[jbjardine]

What changed

• pin the fallback build reference in .env.example
• pin the Compose fallback default to the same upstream commit as the runtime Dockerfile
• strengthen the release regression test so all three references must be immutable and identical
• document the correction for the next release

Why

This addresses the unresolved P2 review thread from #16. The runtime Dockerfile was pinned, but the packaged environment and Compose defaults still overrode that pin with mutable upstream main during local or GHCR-fallback builds.

Validation

• public release regression contracts pass
• resolved Compose configuration contains only da0f365d4a0bcac5371b4962769abc17bfcd8cef
• generated release tarball contains the same pinned reference in .env.example and docker-compose.git.yml

This PR is intentionally left open until the automated review has completed and any additional feedback has been assessed.