fix(ci): Pin the podman image to a live version tag

quay.io no longer serves sha256:7e861e21f62b, the digest pinned for quay.io/podman/stable:latest in extract-prod-binary and container-smoke, so container-smoke fails with "failed to pull image" (a runner configuration error, for example https://gitlab.com/gitlab-com/public-sector/utilities/postern/-/jobs/16950501666). The first commit repoints both pins at the current multi-arch index, sha256:c2c2b4fe8164; the second replaces the digest pin with the version tag quay.io/podman/stable:v5.8.7, which resolves to that same index. A versioned tag with no digest is what the shared Renovate preset recommends, because quay collects superseded digests within days and a :latest digest pin goes stale again, whereas Renovate tracks the version tag and proposes patch and minor bumps itself. Against the quay registry API the old digest returns 404 and both the new digest and v5.8.7 return 200 as an OCI image index; go vet, go test -race and glab ci lint pass on the branch.