Stability checkpoint v0.5.2 — fix smoke:full-stack docker compose --build

- fix(ci): drop --build from test-full-stack.sh (pull from registry, prep v0.5.2) (446071a)

v0.5.1 tag pipeline #113 had smoke:full-stack fail at `docker compose up`
because the script used `--build` which tried a local rebuild that
the docker:24-cli alpine CI container couldn't perform.

Drop --build ; compose now pulls the registry-pushed broker (which
is cosign-signed since v0.5.1's publish:cosign-sign:broker job).
SECURED_CLAUDE_LOCAL_BUILD=1 escape hatch for local dev where
operators don't have registry access.

- ✅ Main pipeline green
- ✅ MR #19 merged
- ✅ Tag pipeline expects 32/32 jobs green (was 31/32 in v0.5.1)