fix(ci): pin ephemeral-server-smoke to a fixed honua-server digest + seed revision

[mikemcdougall]

Problem

ephemeral-server-smoke (.github/workflows/honua-gp-eval.yml) defaulted to the moving ghcr.io/honua-io/honua-server:nightly-aot tag and checked out the honua-server seed fixtures with no ref: (default-branch HEAD at run time). A commit's verdict on this blocking lane therefore depended on whatever honua-server merged that day, and could flip red/green across re-runs with no change in this repo — the same class of problem as honua-sdk-dotnet#300.

Fix

Pin both halves of the target as one identity: HONUA_LOCAL_SERVER_IMAGE now defaults to an immutable digest, and the honua-server seed checkout pins its ref: to HONUA_GP_EVAL_SEED_REVISION — the exact source revision that built that image. Rather than promoting a fresh, independently-moving baseline, this reuses the same already-reviewed pin conformance.yml uses for the Python SDK conformance lane (sha256:78e3088... / f897700...), so the two live-server lanes in this repo share one vetted baseline instead of drifting apart.

This is not a placeholder choice — I reproduced the actual failure mode live:

• Resolving today's nightly-aot (2026-09-10, sha256:cd12f3c...) and standing up the client-compat stack against it 500s: honua-server merged a migration-owned-table journal guard (PostgresCoreSchemaGuard.VerifyExclusiveMigrationConsistency, df25cba60, 2026-09-02) that tests/seed/client-compat-v1.sql does not satisfy (it creates metadata_v2_snapshots/metadata_v2_current directly without a schema_versions journal row), so the server never reaches /healthz/ready.
• The pinned 2026-08-19 baseline (f897700...) starts cleanly, /healthz/ready passes, the SpatialJoin second layer resolves, and the full honua-gp eval suite passes 50/50 against it in live mode (HONUA_GP_EVAL_USE_STUB=0).
• honua-server#2327 (layer-aware OGC-projection wiring the existing job comment depends on, merged 2026-07-01) is an ancestor of the pinned revision, so the Buffer/Dissolve/Project/SpatialJoin live coverage this lane already claims is unaffected.

workflow_dispatch inputs (server_image / seed_ref) and the HONUA_LOCAL_SERVER_IMAGE / HONUA_GP_EVAL_SEED_REVISION repo variables still allow a one-off run against a different build; push/pull_request evidence always uses the pinned pair. The promotion path (resolve digest + revision, verify the seed round-trips against it, update both in a reviewed PR) is documented inline in the workflow.

Acceptance criteria (from #201)

• A recorded decision on whether ephemeral-server-smoke may consume a moving upstream while blocking a commit — no, it is now pinned.
• The digest and seed ref are recorded in-repo (honua-gp-eval.yml env block) with a documented promotion path.

Test plan

• Resolved and locally reproduced the nightly-aot failure against the pinned seed (schema-floor guard mismatch).
• Stood up the pinned docker/client-compat stack locally exactly as the CI job does and confirmed /healthz/ready + the SpatialJoin second-layer check pass.
• Ran packages/honua-gp/eval/run_eval.py in live mode (HONUA_GP_EVAL_USE_STUB=0) against the pinned stack: 50/50 passed (100%); supported 25/25 (100%).
• python3 -c "import yaml; yaml.safe_load(...)" on the edited workflow file.

Closes #201

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.