pipeline 2.2.0

New component for dunn.dev/reference conformance plus catalog runner
relaxation.

ADDED
- reference-check component: clones gitlab.com/dunn.dev/reference at a
  configurable ref (default main), runs 'make guard' to enforce the
  six-primitive whitelist, then runs 'make check REPO=$CI_PROJECT_DIR'
  to verify the consumer against every applicable contract. Single
  exit code answers the operator question 'does this repo conform'.
  Inputs: reference_ref, reference_url, fail_on_violation, job_name.

CHANGED
- Every template + meta-CI: drop 'tags: [storr]'. The catalog is
  runner-agnostic from 2.2.0 onward; consumers opt into larger runner
  classes at the project level. The v2.0.0 'all jobs run on storr'
  contract clause is hereby relaxed.

CI image
- ci:2.2.0 is built on this tag push by the catalog's meta-CI
  container:ci job. Contents unchanged from 2.1.2 (yq/tomlq not yet
  added; planned for 2.2.1 when the reference's web-deploy contract
  ships and starts using check_toml_key).