feat: pack the project's share of the images lock in publish-fragment

[ExtraToast]

Summary

publish-fragment.yml can now pack the project's share of the images lock, the last piece of the ticket's first bullet.

• images-lock-artifact input: the name of an artifact holding images.lock.yml, written by the caller's build with every image the release pushed, by digest, and the user each runs as. It is downloaded outside the checkout and handed to deploy-kit publish --images-lock, which packs only the aliases the project file names and refuses one the lock does not hold.
• Left empty, nothing changes: the fragment carries no share, as before.
• Tests: the option reaches the command only when a lock is named, a named lock that is not there packs nothing, and the workflow fetches the lock outside the checkout. Run by hand against the real command on deploy-kit's auth example: the fragment holds a three-alias share, listed in its manifest.

To know:

• Needs the deploy-kit release that has the option (feat: pack each fragment's share of the images lock, and union the shares in composition deploy-kit#238). A caller that names the artifact while pinning an earlier release gets the command's usage error and no fragment.

Part of JorisJonkers-dev/deploy-kit#195 and #135.