[tufaceous / CI] the control plane tar.gz is not reproducibly built

Currently we have tufaceous generate multiple repos in CI (for the moment, because of different hardware revisions in different racks; soon, because different racks expect different ROT signatures (#3954)). This is done by filling out the TOML manifest with all of the control plane zones as a composite-control-plane source, and tufaceous creates a tarball of the zones. Because we run tufaceous multiple times, we build this tarball multiple times, and the checksums and sizes are not the same across them.

We can try to make tufaceous create tarballs in a reproducible way, or modify CI to create the tarball directly and use a file source in tufaceous instead. Not sure which makes more sense.

No specific files or tests are named. Start with the CI configuration that fills the TOML manifest with composite-control-plane sources, then inspect how tufaceous creates that tarball. Done means repeated CI runs produce matching checksums and sizes, either through reproducible tarballs or a direct file source.