Pin moby/buildkit so buildctl is not ambient #11

The Justfile calls buildctl (two calls, the image-build path via buildkitd) from the ambient PATH; aqua.yaml does not pin it. moby/buildkit is in the aqua standard registry, so this is just do tools add moby/buildkit plus verifying the recipes resolve the pinned binary.

Residue of the 2026-09-06 hermetic-tools handoff; everything else in it (digests through the pinned coreutils, in limen, ossein, ossein-kernel and limen-install) is merged.