stage-0/ is a submodule holding our fork of Aurora (upstream for now),
built with Aurora's own `just build` by the new `task build-base` into
localhost/aurora:stable. The Containerfile (stage 1) now builds FROM
${BASE_IMAGE}, which defaults to that image, instead of a pinned upstream
digest; the pin is now the submodule commit. build-image builds stage 0
first when needed, and BASE_IMAGE=ghcr.io/ublue-os/aurora:stable skips it
(the only option on macOS).
CI checks out submodules, fetches just, yq and cosign, and gets a longer
timeout for the Aurora build.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
