build(deps): refresh UBI9 base images and rebaseline reproducibility digests

[NWarila]

Summary

• Refresh the digest-pinned Red Hat UBI 9 minimal and micro base images across all nine configured sites.
• Update the architecture-specific canonical rootfs reproducibility baselines proven by the prior refresh run.
• Record the artifact-changing refresh in the changelog.

Digest changes

• ubi9/ubi-minimal: ae09ecc3d754bc1726cbda3e2599cc7839e09fe1cc547ce173cf669b645be3cc → 463cae32c6f6f5594b11a5c22de275016bd8545ce58a6373388e8b24f13fc15c
• ubi9/ubi-micro: b498b3ea26111ab4b81d65139f2ebd2ef9a2abb7a4588b7fdcc54889f95e9caa → 35de56a9413112f1474e392ebc35e0cf6f0fb484c8e8877bbae59b513694b41f
• amd64 canonical rootfs: 02ebc1b90cae0c06836b12d0536d52249ee4c8da029c47f8de7bbebe67c04c1b → 3b2a8a220847d9edc939c126208697b9de221b7a7371b26521857534a0179bea
• arm64 canonical rootfs: 851544a92f4cadef30e28048405f154558b70e2ecbe71e517b80c73307605af4 → 4f4d1b58c0352d8d3a6c2435b5bde2f802f0eb93e89593139d62a72d241626d5

Reproducibility evidence

PR #63 reproducibility run 29200750883 built each architecture byte-identically twice with the refreshed bases and reported the new canonical rootfs values above. It also re-proved the recorded rpmdb hashes unchanged: amd64 610f66e9974a9c970323b08b9bee54ae3900d85cd54142baabf832960adebcf6, arm64 af600c390b5d0cb9d0dbf20dc13d74936f610d170b145ea1c3e18ff13359b60c. The recorded fips_so_sha256 values were likewise re-proven unchanged for both architectures.

Because main now uses Dockerfile frontend 1.25 and Buildx v4, this PR seeds the #63 rootfs values as predictions; this PR’s own reproducibility gates are authoritative and will prove or correct them.

Verification

• python3 tools/verify.py