fix(ci): stage complete reproducible infra inputs

bot_bottle/backend/firecracker/infra_artifact.py

@@ -87,6 +87,9 @@ def infra_artifact_version(init_script: str, *, repo_root: Path = _REPO_ROOT) ->
         h.update((repo_root / name).read_bytes())
     h.update(b"pyproject.toml\0")
     h.update((repo_root / "pyproject.toml").read_bytes())
+    h.update(b"dropbear\0")
+    dropbear = util.dropbear_path()
+    h.update(dropbear.read_bytes() if dropbear.is_file() else b"<missing>")
     h.update(b"init\0")
     h.update(init_script.encode())
     return h.hexdigest()[:16]

bot_bottle/backend/firecracker/publish_infra.py

@@ -197,6 +197,7 @@ def main(argv: list[str] | None = None) -> int:
         print(f"built infra rootfs candidate {version}")
         return 0
 
+    assert args.publish_dir is not None
     version = _publish_bundle(args.publish_dir, token)
     print(f"published infra rootfs {version}")
     return 0