dogfood: prevent tool version pin rot in release-branch image builds #30876

Follow-up from review on #30874 (comment).

Problem

Dogfood image builds on long-lived release branches keep breaking from "pin rot": tools installed at build time resolve against today's upstream registries while the base image toolchain is frozen by digest. On release/2.29, cargo install jj-cli typos-cli watchexec-cli@2.3.2 (unpinned, unlocked) started requiring a newer rustc than the pinned base image provides, and the Nix image broke because the pinned nixpkgs fetches a Chrome build Google no longer serves (also seen on 2.34 in #30858).

#30874 fixed 2.29 by pinning jj-cli/typos-cli and adding --locked, which follows what we do elsewhere, but it's a point fix. The same class of failure can recur on any branch that installs tools from upstream registries at image build time.

Context

Per @denisra on #30874, more recent releases moved these tools to mise, so the immediate exposure may be limited to 2.29, which is expected to get about one more release before EOL. Worth confirming whether the mise setup on current branches fully pins versions (and checksums), or whether the same rot can happen there over a release branch's lifetime.

Proposal

Agree on a systemic approach so release-branch dogfood builds stay reproducible, e.g.:

• Audit dogfood image tool installs on main and supported release branches for unpinned or unlocked versions.
• Require exact versions (and lockfiles/checksums where supported) for build-time tool installs.
• Consider periodic scheduled builds of release-branch dogfood images so rot is caught before it blocks a backport.

Created on behalf of @droopy4096