CI: pin ghcr nmisp-test images by digest for reproducibility

`build-test-image.yml` publishes only floating tags:

- `ghcr.io//nmisp-test:latest-2023.09`
- `ghcr.io//nmisp-test:latest-nightly`

`conda_env_test.yml` consumes those floating tags directly. This means a CI run on an unchanged commit can produce different test results if the image is rebuilt between runs (e.g. nightly base updates, or a Dockerfile change in a separate PR).

## Suggested approach

1. After `build-push-action` succeeds, capture the resulting image digest (`steps..outputs.digest`).
2. Write the digest somewhere durable — options:
- Commit a `docker/image-digests.json` file via the existing `git-auto-commit-action` step.
- Or push a `:digest-` tag and have `conda_env_test.yml` resolve it.
3. `conda_env_test.yml` consumes the digest (e.g. `ghcr.io/...nmisp-test@sha256:…`) instead of `:latest-2023.09`.

## Why

Reproducibility: a green CI run today should be reproducible tomorrow on the same commit. Currently it isn't, because the image is mutable. Pinning by digest also surfaces image bumps as explicit commits/PRs that can be reviewed, rather than silently-changing infrastructure.