Bake the active private stack into runner images

[rldyourmnd]

Summary

• advance the baked fleet contract to Bun 1.4.0 and Go 1.26.7
• add Node 26.8.1 beside the retained Node 22/24/25 toolcache entries
• add official actions/python-versions Python 3.14.7 with bundled ensurepip and setup-python-compatible toolcache layout
• advance immutable candidate aliases for all four image variants
• extend provisioning, smoke, manifest and benchmark contracts

Verification

• make verify
• official release checksums verified for Bun, Go, Node and Python assets

No tenant or private inventory is included; this is the generic public image capability.