feat(orchestration): pre-built base images pinned to juice version + kaniko CI Build

Migrates base-image handling from a runtime/CLI migration flow to pre-built, published CI base images that are automatically pinned to the running juice version. Also reworks the CI job.

• A juice version is only guaranteed compatible with the base image published under its matching tag. Assuming latest is unsafe.

juice build --render-only (cli/build.py)

• New flag: render only the Containerfile + pyproject.toml into --output-dir. Lets an external unprivileged builder (Kaniko/buildah) do the actual build. --tag now optional (required unless --render-only); --output-dir required with --render-only.

CI (.gitlab-ci.yml)

• Split Build CI Base Image into two jobs:

  • Render CI Base Image Context — juice build --render-only, exports build-context/ artifact.
  • Build CI Base Image — Build Containerfile with pyproject.toml using kaniko

• New docs/source/concepts/base-images.md (tag derivation) and docs/source/tutorials/admin/pre-built-base-images.md.