ci: pinned matrix image drifts from its build inputs undetected

Every matrix run executes the image pinned in scripts/image, currently
scylladb/scylla-cassandra-unit-tests:java-matrix-driver-20260409, pushed
2026-04-09T14:21Z. scripts/requirements.txt has declared jinja2==3.1.6 — a
Jinja security release — since 2026-04-13 (#140, merged 2026-06-26), and no image
has been rebuilt since: the newest tag in the repository is still
java-matrix-driver-20260409. So the container ships jinja2 3.1.5, in CI and
locally alike, since scripts/run_test.sh:44 reads the pin verbatim into
DOCKER_IMAGE and runs it at line 176.

Two gaps let this persist:

• The IMAGE_SOURCE_PATHS guard (scripts/pr_integration_changes.py:14,56,
  enforced by pr-integration-tests.yml) was added 2026-05-28 in 31078688 —
  after #140 was opened on 2026-04-13. #140 was never re-synchronized afterwards,
  so the guard never evaluated it.
• The guard only inspects a PR's own diff. Nothing compares the pinned tag
  against the current content of scripts/Dockerfile / scripts/requirements.txt,
  so drift already on master — this drift — stays invisible.

Proposed fix (one PR)

• Rebuild and push under a content-hash tag,
  java-matrix-driver-<YYYYMMDD>-<digest8>, the digest covering
  IMAGE_SOURCE_PATHS in sorted path order.
• Add image_source_digest() / expected_image_tag() to
  scripts/pr_integration_changes.py, reusing the existing IMAGE_SOURCE_PATHS
  constant rather than re-listing paths.
• Add image-drift.yml on push: master, pull_request and a daily schedule,
  asserting that the tag in scripts/image ends with the current digest and that
  the tag resolves on Docker Hub. The repository is public, so an anonymous
  registry token is enough — no secrets.
• Keep the existing PR guard. The hash check subsumes it, but its message stays
  the clearer early error for "changed the Dockerfile, forgot the pin".
• Unit-test both helpers, following tests/test_run_test_script.py.

Ordering constraint: the new tag has to be live on the hub before the pin
merges, or every matrix run and every local run_test.sh breaks on an unpullable
image. The push needs scylladb Docker Hub write access (README §"Uploading
docker images").

Out of scope: PyYAML==6.0, psutil==5.9.5, boto3==1.24.17 and
packaging==23.1 are also well behind, but they have not drifted — they match
the built image.

How this was verified

Read-only: the hub tag list and last_pushed timestamps, the commit date of
scripts/requirements.txt (2026-04-13) against the image push (2026-04-09), and
the guard's introduction date. Not verified: the running container's actual
pip show jinja2, which needs a pull.

Start with scripts/pr_integration_changes.py, scripts/image, scripts/Dockerfile, scripts/requirements.txt, and .github workflows; read tests/test_run_test_script.py for the testing pattern. Verify how IMAGE_SOURCE_PATHS and the current pin are used, then run the relevant unit tests and CI checks. Done means a rebuilt content-hash image is available before the pin changes, the workflow detects tag drift and registry resolution, and helper tests pass.