build: pin and verify image inputs

Dockerfile.orchestrator.fc

@@ -12,8 +12,11 @@
 # bare microVM (no fuse-overlayfs / overlay module / subuid maps). The trixie
 # base (from Dockerfile.orchestrator's python:3.12-slim) carries buildah 1.39,
 # which parses the Dockerfile heredocs agent images use (bookworm's 1.28 can't).
-# Matches image_builder.
-FROM bot-bottle-orchestrator:latest
+# Matches image_builder. There is deliberately no default: the build coordinator
+# passes the exact local image ID returned by `docker image inspect`, so this
+# stage cannot silently resolve a stale `:latest` tag.
+ARG ORCHESTRATOR_BASE_IMAGE
+FROM ${ORCHESTRATOR_BASE_IMAGE}
 
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \