chore(infra): pin Docker base images by digest (DEBT-023)

All base images (debian:bookworm-slim, ubuntu:22.04, ubuntu:20.04,
rockylinux:9-minimal, centos:7, alpine:3.19, fedora:39,
kalilinux/kali-rolling, archlinux:latest, honeynet/conpot:latest)
now carry their resolved sha256 digest so 'docker pull' is
deterministic. :tag retained for human readability; @sha256 is what
Docker actually resolves. Refresh procedure documented at the top of
decnet/distros.py.

decnet/services/conpot.py

@@ -25,7 +25,7 @@ class ConpotService(BaseService):
         return {
             "build": {
                 "context": str(self.dockerfile_context()),
-                "args": {"BASE_IMAGE": "honeynet/conpot:latest"},
+                "args": {"BASE_IMAGE": "honeynet/conpot:latest@sha256:cd93e88d9e44b020db691fc4c75cb29e76b5e90ddbc408aca26e6c78c5646976"},
             },
             "container_name": f"{decky_name}-conpot",
             "restart": "unless-stopped",