feat(hi): generic Red Hat Hardened Images application builds

Plan

1. Remove HI source export and redundant selectors, require an explicit application type, and use Buildah only.
2. Cover every current Red Hat Languages/Runtimes catalog entry with a local builder/fixed-runtime template, signed digest-pinned references and fixtures.
3. Verify focused regressions, artifact/variable wiring and complete exact-head build/runtime CI before review; exclude scans only from HI test fixtures as requested by the owner.

Acceptance criteria

• Removed args, build-command, runtime, export-enabled and export-source-path; the component fixes its engine to Buildah and keeps only the builder replacement for assembly customization.
• Source-export calls/artifacts and the obsolete HI command-argument helper are removed. Generic container helpers outside this MR are unchanged.
• Twelve application types cover all eleven entries in the live Languages/Runtimes catalog plus the existing HTML type: Ruby, Rust, Swift, dotnet-sdk, dotnet-runtime and aspnet-runtime are added; Java maps to openjdk.
• .NET runtime versions resolve a compatible SDK major/minor stream instead of requiring identical SDK/runtime patch numbers.
• Ten generator/owner-contract regressions pass. New-contract negative controls fail against the previous source. Four FastCGI cases and the expanded runtime-network/failure/cleanup regression pass.
• Actual generation succeeds for all twelve contexts with 22 unique live Red Hat image signatures verified against the fixed key. This proves resolution/signature/artifact generation, not application build/runtime success.
• Earlier parent/expanded-child lint verified twelve generators, twelve builds, twelve scans and the runtime job. That historical scan requirement is superseded by the owner amendment below.
• Markdown/Vale checks pass; rendered guide and final scoped source diff are reviewed.
• All twelve HI test fixture includes set scanning-enabled: false, as requested by the owner. The public HI component still defaults to scanning-enabled: true; unrelated components and production scanning are unchanged.
• Local HI runtime regression passes; all twelve required build dependencies and runtime checks are preserved.
• Complete required CI for the explicit-type amended head, including all twelve actual uploads, builds and runtime checks; HI fixture scans stay excluded.
• Final amended-head DoD and owner feedback verified before resolving the new discussion or requesting review.

Previous-head validation (not explicit-type amendment acceptance)

Exact-head CI succeeds on d122f8c1: 63 fully paginated root/downstream pipeline nodes and 248 finished jobs, with no required failures or unfinished jobs. Three existing optional catalog fixture failures remain visible; no required check was bypassed.

The HI child passes all twelve generator artifact uploads, twelve actual image builds and the required runtime proof. It verifies the ten command-based stacks, default PHP-FPM FastCGI, HTML HTTP, non-root identity and service-container cleanup. The Python fixture also requires corrected bundled certifi in both interpreters.

All current owner amendments are verified: export and redundant public selectors are removed, Buildah is fixed, all twelve local stack templates use a replaceable builder/fixed runtime, numeric catalog versions resolve signed digest-pinned references, and scan exclusions apply only to HI test fixtures. Production scanning defaults remain enabled; #423 remains a separate upstream vulnerability investigation, not a claim that the Ruby vulnerability is fixed.

The complete 44-file scoped diff, current default-branch instructions, unchanged current-main rebase, documentation and all owner discussions are reviewed. Current-head documentation, spellcheck and required Bash checks pass. No source change or replacement pipeline is needed. Ready for guarded reviewer selection; review/approval requirements remain separate from this validation.

Closes #419 (closed) Closes #422 (closed)

Explicit stack selection amendment

• Removed the Node.js default from type; callers must explicitly select a supported stack.
• GitLab component lint rejects an omitted type and accepts each of the twelve explicit stack values on 9ffaffdb.
• Ten generator tests, four FastCGI cases and the runtime/network/failure regression pass. Markdown lint, Vale and the full Docusaurus build pass; the rendered guide and two-file diff are reviewed.
• Complete new-head CI and final DoD. The previous successful pipeline does not validate this amendment.

The MR is draft/in-progress and the new owner discussion remains open until the amended checks are verified. Existing reviewers are unchanged.

Explicit-type CI verification and required current-main rebase

Completed the live recursive audit of the explicit-type preceding-source pipeline at 9ffaffdb: all 63 root/child pipeline nodes succeed across 248 jobs. The three failed jobs are unchanged declared negative fixtures with successful required verifier paths; all six identified stop/cleanup jobs pass. Both separately API-triggered workflow test-project pipelines also pass all their jobs. This verifies the preceding explicit-type source, not a rebased head.

The fast-forward target has advanced by the unrelated digest commit. Rebased and published a35e005c with an exact source-SHA lease and CI skipped. All 14 feature patches remain byte-equivalent; owner changes, explicit required type, all twelve stacks and the owner-requested HI-fixture-only scan exclusion are preserved. Ten generator/owner-contract tests, four FastCGI checks, actual runtime failure/network/cleanup regression, root CI compilation and whitespace checks pass. No production scan default or ordinary check changed.

Both independent work-CI slots are active, so complete rebased-head CI is queued; the skipped push and preceding success are not current-source acceptance. Keep draft, existing reviewers and the No-default owner thread unchanged until complete new-head CI, final diff/rebase and final DoD pass. Moving the related item out of its stale review state to reflect this amended-source validation wait; no reviewer request, approval, merge or third pipeline was made.