v0.3.0 — reproducible full Codexbox image

Add CODEXBOX_FULL=1 for the general-purpose development-toolchain image;
minimal remains the default. Parent images and tool inputs are pinned and
locked, and the installer/wrapper selection plus full toolchain are covered
by regression tests.