fix: package canonical provision scripts in API image

The immutable API release image omits canonical provisioning entrypoints expected relative to its configured WorkingDir, so the migrate stage cannot start. Add an image-content regression gate for the API-image scripts invoked by cloud provisioning and minimally fix the Dockerfile/build context so those entrypoints and runtime dependencies are present. Preserve immutable OCI revision validation and fail closed.

Start with the API image Dockerfile and its build context, then trace the canonical provisioning entrypoints used by the migrate stage and their runtime dependencies. Done means the image-content regression gate passes, the migrate stage can start from the configured WorkingDir, and immutable OCI revision validation still fails closed.

Written by the indexing model from the issue text.