publish-golden-image: content-addressed tarball names

Embed the sha256 prefix in the uploaded filename so every rebuild
lives at a unique URL. Cloudflare's edge cache (and any similar CDN
in front of R2) can never serve stale bytes for the URL the catalog
points at. The R2 console offers no per-URL purge for this bucket
layout, so making the URL itself content-addressed is the only
durable fix.

Also republishes the debian-bookworm catalog entry with the new
filename.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/imagecat/catalog.json

@@ -6,9 +6,9 @@
       "distro": "debian",
       "arch": "x86_64",
       "kernel_ref": "generic-6.12",
-      "tarball_url": "https://images.thaloco.com/debian-bookworm-x86_64.tar.zst",
-      "tarball_sha256": "d035010db47bfa93a1d0275bf6f14c440b4e4eff2119bc82371b640be99623d6",
-      "size_bytes": 289965534
+      "tarball_url": "https://images.thaloco.com/debian-bookworm-x86_64-e5000c22ea98.tar.zst",
+      "tarball_sha256": "e5000c22ea9801b25425361628ea177328e0fa85181dd00775c09f77d0c5baf2",
+      "size_bytes": 289965264
     }
   ]
 }