v3.0.2 — fix seven Phase A bugs surfaced by first real CI

Bundles MR !1 (qemu pkg + podman storage + tiny test base + workflow
rules + buildah/skopeo pins) and MR !2 (cleanup entrypoint override),
plus the container_registry_enabled project setting that was masking
empty ${CI_REGISTRY_IMAGE} expansion.

Consumers on v3.0.1 should bump:
- basef: just a tag pin change
- carmine: just a tag pin change

Behavior change: workflow.rules now suppresses merge_request_event
pipelines on the catalog itself. Branch pushes drive CI on the
catalog. (Consumers' workflow rules are independent and unchanged.)