Accept a deployer-supplied extra toolchain lock at build time #3692

Problem

The managed toolchain release ships a fixed set of tools (see docs/MANAGED-TOOLCHAINS.md). An operator who needs a tool outside that set currently installs it by hand on each host. Those installs are unpinned, not in the managed mount, not scanned, and not reproducible across hosts.

Proposal

Let the build take an optional extra lock file, in the same shape as the managed tools.lock.json, and merge it into the release's managed mount at build time.

• Each entry pins a version, a source URL and a SHA-256 digest. An entry without a digest fails the build.
• Extra tools resolve through the same current/bin path as managed tools, for the run user as well as the owner.
• containarium toolchain list shows managed and extra tools, with version and source for each.
• The release's scan and SBOM cover the extra binaries.

The contents of any particular extra lock are the operator's choice and are out of scope here.

Acceptance criteria

• A build given an extra lock merges its entries into the managed mount.
• A build fails when an extra entry has no digest.
• An extra tool resolves at its pinned version for the run user, not only for the owner.
• containarium toolchain list shows extra tools with version and source.
• The scan and SBOM include the extra binaries.