Build tooling should validate that the pinned base image defines the user the generated Dockerfile switches to

## What

Nothing in the connector build tooling validates that a connector's pinned `connectorBuildOptions.baseImage` actually defines the user the generated Dockerfile switches to. `docker-images/Dockerfile.manifest-only-connector` ends with `USER airbyte`, but that user only exists in newer `source-declarative-manifest` base images.

`source-salesloft` and `source-aws-cloudtrail` were still pinning `source-declarative-manifest:5.15.0`, which has no `airbyte` user. Their images built successfully and then failed at container start:

```
docker: Error response from daemon: unable to find user airbyte: no matching entries in passwd file
... non-zero exit status 125
```

That silently broke the pre-release publish workflow, the regression-test harness (failing at `SPEC` with `Internal failure: true`), and each connector's CI image/spec check. See airbytehq/airbyte#84349 and the fix in airbytehq/airbyte#84350.

## Suggested guard

A metadata QA check or build-time assertion that fails with a clear message when the pinned base image does not define the user the generated Dockerfile selects — e.g. after building, run `id airbyte` (or `getent passwd airbyte`) in the image and fail with something like "base image `` does not define user `airbyte` required by Dockerfile.manifest-only-connector; bump `connectorBuildOptions.baseImage`".

A cheaper complementary check would be a metadata lint that flags base image pins more than N minor versions behind the current SDM pin, since the underlying problem was a stale pin that nobody noticed for ~a year.

## Context

Filed as a follow-up from the `/ai-fix` workflow on airbytehq/oncall#13301, at the request of `aaronsteers`. Not urgent — the two affected connectors have been bumped — but the class of failure is easy to reintroduce and currently surfaces only as an opaque exit-125 at publish time.

---
**Internal Tracking:** https://github.com/airbytehq/oncall/issues/13302

Start by tracing connectorBuildOptions.baseImage through the connector build tooling and compare it with docker-images/Dockerfile.manifest-only-connector, which selects the airbyte user. Run the affected connector image or spec checks to reproduce the opaque exit-125 failure, then add validation that reports a clear error when the pinned base image lacks that user; the checks should pass for valid pins.

索引モデルが issue の本文から書いたものです。