[minor] Harden ISLE template lifecycle

[libops-agent]

Summary

• enforce scoped one-shot database initialization for Drupal and optional Fedora services
• wire authenticated ActiveMQ credentials consistently into ActiveMQ, Alpaca, and rendered Drupal settings
• remove Docker socket coupling, align component/profile contracts, and pin all direct LibOps images to published multi-architecture digests

Validation

• docker compose config --quiet, including explicit broker secret target assertions
• Buildkit hosted image tests and coordinated sitectl create smoke: https://github.com/libops/buildkit/actions/runs/29165298540
• this PR runs the full ISLE template smoke on GitHub Actions