Implement chroot pinning for pkg-builder env

[eniko1556]

Summary

pkg-builder's test workflow creates a fresh sbuild chroot from the latest distro repo on each CI run. When packages receive updates (e.g. gcc-12 security fix in bookworm 12.11), the build output changes and verification hashes break.

In eth-nodes, this is handled by saving the chroot tarball as a release asset, so verification rebuilds use the exact same environment.

Proposal

pkg-builder should support pinning the chroot environment in some way, so that pkg-builder env create produces or uses a reproducible environment. Options to consider:

• Save and restore chroot tarballs (like eth-nodes does via release assets)
• Support Debian snapshot archives (snapshot.debian.org) to pin package versions by date
• Record installed package versions in the build output for reproducibility tracking

Context

• Issue Investigate bookworm C build reproducibility #38: bookworm C/Rust/Nim hash mismatches caused by gcc-12 update
• The gcc-12 update (CVE-2023-4039, stack protector fix) shipped in bookworm 12.11 (2025-05-17) and changed native binary output