chore(ci): assert the busybox/coreutils layer, and record the derived audit

The toolchain check's own comment said the quiet part: "the list only covers what
someone remembered to add". So the list was derived instead of remembered — every
command invoked from a `run:` block across zegit's Gitea-executed workflows and
composite actions was extracted and checked against this image.

Result: no missing apk package. Everything resolves to one of three sources —
baked in here, provided by busybox/coreutils, or downloaded per-run and
immediately version-checked (go via setup-go, buildctl, flux, cosign, syft,
goreleaser). The download path needs nothing from this image beyond curl and tar,
both already asserted.

What the audit did find is that the busybox/coreutils layer was entirely
unasserted. Dropping `coreutils` from the apk line would pass this check while
base64, mktemp, seq and sort silently vanished — and on this repo's own history,
their absence would be narrated as whatever the gate reaching for them happened
to be doing, not as a missing tool. That is how openssl became "signature FAILED
verification" and jq became "not a signed DSSE envelope".

Verified by executing the assertion, not by reading it: extracted the inner
script and ran it against a PATH with base64 deliberately absent. It printed
base64=MISSING and the outer `grep -q MISSING` failed the build. Against a full
PATH it reports zero MISSING.

.github/workflows/build-image.yml

@@ -109,6 +109,22 @@ jobs:
       # missing tool, blocking v0.0.134 and v0.0.135. The list only covers what
       # someone remembered to add, so add to it whenever a gate grows a new
       # shell dependency.
+      #
+      # DERIVED once, 2026-08-31, rather than remembered: every command invoked
+      # from a `run:` block across zegit's Gitea-executed workflows and its
+      # composite actions was extracted and checked against this list. Result:
+      # no missing apk package. Everything resolved to one of three sources —
+      # baked in here; provided by busybox/coreutils; or downloaded per-run and
+      # immediately version-checked (go via setup-go, buildctl, flux, cosign,
+      # syft, goreleaser). The download path needs nothing from this image
+      # beyond curl and tar, both already asserted.
+      #
+      # What the audit DID find is that the busybox/coreutils layer was entirely
+      # unasserted, so dropping `coreutils` from the apk line above would pass
+      # this check while base64, mktemp, seq and sort silently vanished — and by
+      # the history above, their absence would be narrated as whatever the gate
+      # using them happened to be doing. They are asserted below now. They are
+      # cheap to check and the failure they prevent is expensive to read.
       - name: Verify the image still contains the toolchain the gates need
         if: ${{ steps.meta.outputs.push == 'true' }}
         run: |
@@ -129,6 +145,11 @@ jobs:
               command -v tar      >/dev/null && echo "tar=ok"      || echo "tar=MISSING"
               command -v openssl  >/dev/null && echo "openssl=ok"  || echo "openssl=MISSING"
               command -v jq       >/dev/null && echo "jq=ok"       || echo "jq=MISSING"
+              # busybox/coreutils layer: used across zegit's gates for base64
+              # decoding of DSSE payloads, temp dirs, poll loops and sorting.
+              for t in base64 mktemp seq sort sed grep cut head wc uname date; do
+                command -v "$t" >/dev/null && echo "$t=ok" || echo "$t=MISSING"
+              done
               [ -x "$(git --exec-path)/git-http-backend" ] \
                 && echo "git-http-backend=ok" || echo "git-http-backend=MISSING"
             ' 2>&1) || { echo "::error::could not run $REF on $plat"; fail=1; continue; }