feat: add rootless nginx development image

[joey-huckabee]

Summary

• build an exact Red Hat nginx-core RPM into a package-manager-free UBI 9 Micro runtime
• run directly as 999:0 with unprivileged ports, read-only-root compatibility, immutable log links, and no entrypoint privilege phase
• add Bash and PowerShell restricted-runtime smoke suites plus hardened Compose defaults
• extend CI with native AMD64/ARM64 builds, Trivy, Syft SPDX, Grype, artifacts, SARIF, and an aggregate image check
• add the required pre-release version-contract discussion to the forward-looking roadmap

Local validation

• Podman build succeeded on engine 5.3.1
• PowerShell restricted-runtime smoke suite passed for fixed and arbitrary UIDs
• final image user is 999:0 and package managers are absent
• pre-commit run --all-files --show-diff-on-failure passed