feat: make prebuilt image updates metadata-first

[joecklau]

Summary

• Reduce scheduled source checks to the upstream-aligned weekly cadence with a 6–12 hour delay.
• Verify the signed catalog entry and immutable GHCR package metadata before skipping unchanged builds.
• Publish candidate catalog state safely and guard catalog/alias updates against stale pointers.

Verification

• YAML duplicate-key parsing passed.
• All embedded workflow Bash blocks and the catalog fetch script passed syntax checks.
• git diff --check passed.
• Go tests and gofmt remain to be run in an environment with Go installed.

Notes

The branch is based on develop. The workflow continues to fail closed when package metadata or catalog state is ambiguous or stale.