containers

fix(pia): install GNU sed so upstream's `sed --unbuffered` works

fix(ci): name docker exporter inline so push-by-digest doesn't choke

ci: collapse test+release builds, extract build-and-test composite, bump checkout

ci: drop leftover per-arch validate-cue step from ci-cd images-test

ci: consolidate CUE validation into a single up-front job