fix(solmara): pin release candidates explicitly

[jeremi]

Summary

• requires an explicit Registry Stack tag for release-candidate review
• preserves no-argument just review for normal CI and contributors
• validates candidate tags before filesystem or registry access and passes them safely through the workflow
• makes committed versions.env authoritative, rejecting mismatched Relay/Notary overrides before GHCR lookup
• makes just lint fail when Compose fallback digests differ from versions.env

Closes #5.

Security and release boundary

The candidate tag is passed through the workflow environment and a shell-safe positional Just argument. Invalid or hostile tags, including separators, quotes, command substitutions, whitespace, and newlines, are rejected before file or Docker access. Images remain digest-only and no secret handling or topology changes are included.

Verification

• focused pin tests: 11 passed both with and without workflow-equivalent ambient image variables
• just lint
• just test, including 86 script tests
• just compose
• just review
• just review-release v0.10.0, including live GHCR digest validation
• actionlint
• Bash syntax, Python compilation, and committed diff checks
• independent review and re-review: no findings

The full GitHub Actions workflow has not yet run on this branch; this draft PR is the remote gate.