feat(init): source Nitro contracts from release or workspace

[douglance]

Summary

• replace init/bake Nitro version and branch selectors with a resolved contracts source
• prefer NITRO_CONTRACTS_LOCAL_DIR, then a prepared sibling checkout, then pinned Nitro Contracts v3.2.0
• pass the selected checkout through a BuildKit named context and reject incomplete workspaces early
• stop producing new v2.1 builds while retaining existing published-image resolution
• replace the bake action's version/branch inputs with nitro-contracts-ref

Compatibility

• start and the run action retain nitro-contracts-version for selecting existing published images
• existing v2.1 images remain resolvable; new init/rebuild and release publishing use Nitro 3.x
• the default release is v3.2.0 at 2695e7b3e3f460531e2b77fed48a60561c54d90e

Checks

• pnpm lint
• pnpm build
• pnpm typecheck
• full 222-test Vitest suite with external artifact paths redirected to temporary fixtures
• deployer Docker build from the pinned Git context
• deployer Docker build from a prepared local v3.2.0 checkout
• git diff --check

Supersedes #37, which remained based on the already-merged #34 branch and cannot be safely rewritten without a force-push.

[douglance]

Rebased onto main (which now carries the Docker Hub registry work: #41, #42, #43, #45). Force-push to this branch is blocked for me, so the rebased result is on rebase/nitro-contracts-source — fast-forward this branch onto it, or repoint the PR.

Conflict resolved

One conflict, in .github/workflows/release-testnode-image.yml: this PR deletes the nitro-contracts-version dispatch input, while main added dockerhub-repository and overwrite next to it. Kept both new inputs and took this PR's deletion.

Validation after rebase

pnpm lint, pnpm typecheck clean. pnpm test:run 256/259 — the 3 failures are the pre-existing packages/core/test/token-bridge.test.ts env failures that also fail on main (they need yarn install in a sibling token-bridge-contracts checkout).

Compatibility note worth acting on

This PR makes publishRowsForVariant drop everything but DEFAULT_NITRO_CONTRACTS_VERSION, so:

resolvePublishMatrix('all', 'all')  -> 7 rows, v3.2 only   (was 11 across v2.1 + v3.2)
resolvePublishMatrix('all', 'v2.1') -> 0 rows

That is intended for publishing, but mirror-to-dockerhub.yml on main derives its tag list from the same function. After this merges, mirroring a pre-existing release would silently omit its 4 nc2.1 tags, and passing nitro-contracts-version: v2.1 would fail with empty mirror matrix. Fixing that belongs in the mirror workflow, not here — it should enumerate tags that exist at the source (crane ls) rather than re-deriving what a release would publish. I'll open that separately.