refactor: cut over OCI builds to FSDK

[castrojo]

Summary

• remove the obsolete Rockcraft manifest and Rock-only service launchers
• replace Docker Hub and mutable-tag instructions with the immutable Project Bluefin GHCR/BuildStream workflow
• harden stateful driver coverage, exhaustive image inventory, rootless Podman behavior, and source fetch retries
• use Debian's authoritative checksummed JBIG-KIT tarball and aliased CPAN sources
• keep dependency verification read-only, mint Mergeraptor credentials only for the proposal step, and attribute commits to the App bot account
• preserve Snap packaging byte-for-byte from the parent branch

Verification

• just verify — every lifecycle, payload, raster, packaged, stateful, and parity gate passed
• just verify-stateful-drivers repeated three times without failure
• just sbom — valid SPDX 2.3 document, 837 packages
• actionlint .github/workflows/*.yml
• source inventory check — 30 external BuildStream sources
• Mergeraptor organization secrets confirmed available
• git diff --exit-code feat/fsdk-dependency-updates..feat/fsdk-cutover -- snap/snapcraft.yaml

Physical USB/network validation remains manual by design.

build-snap reports the same pre-existing libcupsfilters/libjxl failure as main run 35136617503. The Snap manifest is unchanged by this PR and the failure is not an FSDK regression.

Stacked on #8 (feat/fsdk-dependency-updates).