fix: bake openssl and jq into the runner image, and assert them

The release tag gate parses the Control Plane quorum verdict and verifies its
Ed25519 DSSE signature by shelling out to jq and openssl. Neither is in this
image, and both call sites read cmd ... || { echo <security message>; exit 1; },
so command-not-found took the failure branch: the gate reported a valid, signed
approval first as "not a signed DSSE envelope" and then as "signature FAILED
verification". That blocked v0.0.134 and v0.0.135 on 2026-08-31 and pointed the
investigation at the Tag Request rather than at this image — the same shape as
the git-daemon gap already documented above the package list.

Also adds both to the toolchain assertion. That check already existed and still
missed them, because it only covers what someone thought to list; the comment
now says so, and says to extend it whenever a gate grows a shell dependency.

Verified by building this image and running the gate script inside it against
the live Control Plane: openssl 3.5.8, jq 1.8.1, and the v0.0.135 verdict
verifies and binds to its commit. The unpatched image fails the same script.

.github/workflows/build-image.yml

@@ -101,6 +101,14 @@ jobs:
       #
       # Asserted on BOTH architectures, because a package that resolves on amd64
       # and not on arm64 would otherwise reach half the nodes unnoticed.
+      #
+      # openssl and jq were added after this check already existed and still
+      # missed them: the release tag gate shells out to both to verify the
+      # Control Plane's signed quorum verdict, and their absence surfaced as
+      # "verdict not signed" / "signature FAILED verification" rather than as a
+      # missing tool, blocking v0.0.134 and v0.0.135. The list only covers what
+      # someone remembered to add, so add to it whenever a gate grows a new
+      # shell dependency.
       - name: Verify the image still contains the toolchain the gates need
         if: ${{ steps.meta.outputs.push == 'true' }}
         run: |
@@ -119,6 +127,8 @@ jobs:
               command -v make     >/dev/null && echo "make=ok"     || echo "make=MISSING"
               command -v curl     >/dev/null && echo "curl=ok"     || echo "curl=MISSING"
               command -v tar      >/dev/null && echo "tar=ok"      || echo "tar=MISSING"
+              command -v openssl  >/dev/null && echo "openssl=ok"  || echo "openssl=MISSING"
+              command -v jq       >/dev/null && echo "jq=ok"       || echo "jq=MISSING"
               [ -x "$(git --exec-path)/git-http-backend" ] \
                 && echo "git-http-backend=ok" || echo "git-http-backend=MISSING"
             ' 2>&1) || { echo "::error::could not run $REF on $plat"; fail=1; continue; }