ci: smoke every image variant, not just fips-debug

The pipeline builds six variants and executes one. Both FIPS smoke jobs run the -fips-debug image, so the shell-free standard images we market for Kubernetes, Argo, and Tekton ship without ever being started, and neither warmer image runs at all.

Five jobs close that. debug-smoke runs the -debug image as the job image, like the FIPS jobs. The standard variants are UBI9-micro with no shell, so entrypoint: [""] has nothing to exec; standard-smoke and standard-fips-smoke run them through docker-in-docker, which starts the published bytes under their own ENTRYPOINT. It needs a privileged runner; the saas-linux-* tags provide one.

warmer-roundtrip and warmer-fips-roundtrip fill a cache volume with the smoke base, then require the matching executor to log Found <digest> in local cache while building from it. Both pass --no-push, so they assert the cache read path and make no claim about the OCI manifest push defect the README records.

Proof: with podman locally, the published v1.25.19 and v1.25.19-warmer images ran this argument shape and produced every asserted line.

Cost is five jobs, about 16 minutes of runner time, and 4 minutes of wall clock in verify. A reviewer checks the five are green on the MR pipeline and that main stays image-free.