Repin the CI images onto the refreshed build

[Bronek]

Repin every CI image onto a freshly built set, converging the pins back onto a single sha.

What moved

ci-docs was rebuilt by #389; ci-build (16 images) and ci-pre-commit were then dispatched against the same main commit, so all eighteen images carry the tag sha-95f599d and every consumer moves together:

workflow	image
build.yml	ci-build-<compiler> — 14 matrix compilers
package-test-bazel.yml	ci-build-gcc-bazel:16, ci-build-clang-bazel:22
package-test-conan.yml	ci-build-gcc:16
sonarcloud.yml, sonarcloud-pr-scan.yml	ci-build-gcc:15
pre-commit.yml	ci-pre-commit
docs.yml	ci-docs

The two sonarcloud workflows move together by necessity: the consumer analyses the compile_commands.json the producer wrote, so the compiler paths recorded there have to resolve to the same toolchain in both.

What this is worth

The images were built 2026-06-21; the replacements were built today, so they carry five weeks of upstream drift — Debian trixie packages, and whatever moved in the gcc and clang base images. Note that the Docker official gcc image tracks upstream releases only, so the distro-produced 16.1.1 is not among the changes.

Verification

Before repinning, every tag was probed in the registry: all fourteen build.yml matrix compilers, both bazel variants, ci-pre-commit and ci-docs — eighteen manifests, all present, each a multi-arch index carrying linux/amd64 and linux/arm64.

Beyond that, this pull request is its own evidence: build across fourteen compilers, both packaging routes, coverage, sonarcloud, pre-commit and the docs site all run on the new images here. A regression in any of them is the point of doing this as one change rather than discovering it at the next scheduled rebuild.

Infrastructure-only change: no test accompanies it, as the workflows it repins are the test.

Assisted-by: Claude:claude-opus-5

[augmentcode]

🤖 Augment PR Summary

Summary: Repins the GitHub Actions workflows to use refreshed CI container images tagged sha-95f599d (build/docs/pre-commit/packaging/sonarcloud).
Why: Keeps all CI lanes converged on the same newly built toolchain/image set so consumers move together and remain compatible.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud