ADR: source GitHub CLI immutably for MicroVM images

[gregario]

Adds a short proposed ADR for the MicroVM GitHub CLI dependency.

It follows the build failure in #122 and asks for alignment before implementation: use versioned GitHub release artifacts with architecture-specific SHA-256 checksums rather than a versioned RPM from a rolling repository.

This PR intentionally adds only the ADR; it does not change production code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rajpratham1]

This is a well-written ADR that clearly justifies moving from a mutable package repository to immutable, checksum-verified release artifacts to improve build reproducibility. There are no blocking issues.

[edbror]

Supporting data point for this ADR: the failure it addresses recurred today on CLI 0.1.5.

The bump from #163 (gh-2.96.0-1 → gh-2.97.0-1) has itself expired — cli.github.com's RPM repo now serves only gh-2.98.0-1, so a fresh qm infra build-image fails with No package matches 'gh-2.97.0-1'. Details in #122 (comment).

That makes three versions in the sequence 2.96.0 → 2.97.0 → 2.98.0, each valid only until the next gh release. It supports the framing in this ADR: the problem is not the specific version but sourcing from a rolling repository that retains a single build, so every pin has a bounded lifetime and bumping resets the timer rather than resolving it.

Two observations that may be worth folding in:

1. The failure is undiagnosable on AWS. Lambda MicroVM image builds report only The container image build failed. and create no CloudWatch log streams, so there is nothing to inspect in the account. I only identified the cause by rebuilding the generated Dockerfile locally against the pinned base image. That raises the cost of each recurrence well above a normal broken build — the operator's visible symptom is a stalled deploy with no error.

2. The proposed approach is already the local idiom. awscli and litestream are installed a few lines below in the same Dockerfile via versioned release artifacts with SHA-256 checksums and an arch case statement. Applying the same pattern to gh would make that file internally consistent as well as immutable.

[16francej]

Thanks for the ADR. This landed in #717 (immutable GitHub CLI install for the MicroVM image, versioned release artifacts with checksums instead of the RPM pin). Closing in its favor.