perf(e2e): reduce rebuild-hermes runtime with pinned fixtures and reusable build cache

Parent epic: #7140

### Problem

The `rebuild-hermes` E2E lanes spend most of their wall time preparing images and dependencies rather than exercising the rebuild behavior.

Recent evidence recorded in #7140 shows:

- normal lane: about 16m19s;
- stale-base lane: about 18m22s;
- roughly 90% of the time is image, installer, and dependency preparation; and
- the rebuild operation itself is roughly 59–80 seconds.

The normal lane currently builds the current Hermes base during setup and then reaches a forced-build path during rebuild because the synthetic old sandbox has no resolvable base-image metadata. The same expensive dependency layers can therefore be prepared twice in one job.

### Scope

- Remove the redundant normal-lane current-base build, or pass immutable image/ref metadata from setup into rebuild so the exact prepared image is reused.
- Publish the fixed old Hermes E2E fixture as an immutable digest and pull it instead of rebuilding it in every job.
- Evaluate an immutable current-base fixture where that does not bypass the behavior under test.
- Persist reusable BuildKit cache across jobs and add cache mounts for npm and uv downloads while preserving lockfile and digest validation.
- Separate installer/bootstrap contract coverage from rebuild-state coverage where the full installer is not part of the assertion.
- Keep the stale-base lane's real regression boundary: it must still prove stale local metadata is detected and refreshed.
- Coordinate any general prebuilt-artifact contract with #6402 without expanding this issue into product-facing onboarding behavior.

### Acceptance criteria

- The normal lane constructs or downloads the current Hermes base once, not twice.
- The stale fixture is pinned by immutable digest and its provenance is verified before use.
- Both lanes still verify state backup/restore, sandbox replacement, readiness, and the expected final base digest.
- Before/after timings are collected on the same runner class across repeated runs.
- Median wall time improves by at least 25% without weakening assertions or increasing retry count.
- Cache misses and fixture publication failures fail clearly and do not silently fall back to an unpinned image.

### Non-goals

- Changing Hermes product behavior.
- Masking deterministic test failures with retries.
- Removing the stale-base regression lane.