Pin Dockerfile builder images to immutable sha256 digests

## Objective

Pin `blackdex/rust-musl:x86_64-musl` and `blackdex/rust-musl:aarch64-musl` builder base images in `Dockerfile` to immutable `@sha256:...` digests.

## Context

Lines 4–5 of `Dockerfile` currently use mutable platform tags:
```dockerfile
FROM --platform=$BUILDPLATFORM blackdex/rust-musl:x86_64-musl AS builder-amd64
FROM --platform=$BUILDPLATFORM blackdex/rust-musl:aarch64-musl AS builder-arm64
```
Mutable tags can change upstream without notice, introducing non-reproducible builds, unexpected compiler differences, or supply-chain security risks. Pinning by digest ensures cryptographic immutability.

## Deliverables

- [ ] Inspect upstream digests for `blackdex/rust-musl:x86_64-musl` and `blackdex/rust-musl:aarch64-musl`.
- [ ] Update `Dockerfile` to pin both builder images by `@sha256:...` digest.
- [ ] Document the image digest update process in `docs/supply-chain.md`.
- [ ] Verify that Docker container builds succeed on both amd64 and arm64 targets.

## Acceptance Criteria

- [ ] Builder images in `Dockerfile` are pinned to immutable sha256 digests.
- [ ] Multi-architecture builds succeed with the pinned digests.

## References

- `Dockerfile` (lines 4–5)
- `docs/supply-chain.md`
- Arc review: `arc-review/finalReview/release-supply-chain/README.md` (PoC 9)