3.0.0 - baked-recipe component model

BREAKING: every component's logic now lives in pipeline.just, baked into
the ci-* images at /opt/dunn-pipeline/justfile. Templates are thin `just`
wrappers and inputs pass via variables:. The `image:`-override escape
hatch (run a component on a vanilla base and install tools on-demand) is
removed: overriding `image:` to a base without the baked justfile will
fail. Pin a ci-* image (the default) or fork the recipe.

Migrated families: go, rust, node, the L0 gate (osv-verdict +
automerge-gate), the ops/deploy family (cloudflare-pages/worker/r2,
reference-check, slsa-attest, release-create, claude-drift-triage), and
container-sbom. container-image stays inline by design (foreign buildah
image, no baked justfile).

No consumer-facing contract change: every component's inputs, artifacts,
and behavior are identical to 2.7.0. Only the internal execution model
changed.