2.3.0

Major catalog uplift for the dunn.dev estate supply chain:

- node-* templates (node-build, node-audit, node-publish, node-sbom)
  bring npm packages to parity with Go binaries: signed releases via
  cosign sign-blob of the tarball, CycloneDX SBOM, npm publish to
  GitLab project registry.
- container-sbom template: CycloneDX SBOM for built container images
  via syft scanning the pushed registry image.
- container-image: new publish_at_root mode for estate-shared images
  (e.g. dunn.dev/caddy-estate) that publish at the registry repo root
  instead of an image_tag sub-path.
- ci-runtime-node: new UBI 9 nodejs-22-minimal runtime base for Node
  SSR consumers. Pairs with container-image (from_artifacts: true).
- ci-rust: Zig 0.15.x URL naming fix (arch order changed upstream).