[patch] Pin published image digests

[libops-agent]

Summary

• pin The Islandora runtime and dependent service images to immutable multi-architecture OCI digests
• retain readable version tags so downstream forks can see and deliberately update application/runtime versions
• preserve template-level build arguments for supported site overrides

Validation

• shell and Compose configuration contracts passed locally
• image indexes were verified for linux/amd64 and linux/arm64
• GitHub-hosted template smoke is the merge gate

The OJS and Omeka image pins come from the fully green Buildkit main publication run 29208590233.