pin agent container image instead of spawning from :latest

[michaelfward]

spawning from :latest meant the fleet's browser version was whatever the last app-building push happened to bake (recordings ran a 2 month old chromium through late june). this pins an immutable tag in netlify/functions/lib/image-ref.ts; app-building's build workflow bumps it automatically after each image build (replayio/app-building#341), and the bump commit deploys + drains the warm pool so new pods pick it up.

tag format is <app-building git sha>-<baked chromium buildId>, so a bump diff shows the browser change directly. the initial pin points at the digest that's already deployed (b25b6bad7ac2, chromium 20260701) via a tag pushed for it, so merging this changes nothing until the first bump.

CONTAINER_IMAGE_REF env still overrides, for one-off experiments.

test plan

• tsc clean (0 errors)
• merge after rebuild container image on browser releases + versioned tags app-building#341 and its LOOP_QA_BUMP_TOKEN secret are in place, else the pin freezes the image
• after the next image build: bump commit lands, deploy runs, new pods spawn from the pinned tag

[github-actions]

🔎 Loop QA preview (all-k8s backend): https://pr-34--loop-qa-j63k5x.netlify.app