v9.5.0 — chunkah rechunk on base-zfs-nvidia + reproducible input

base-build-scratch rechunks the final base-zfs-nvidia candidate through
coreos/chunkah and republishes it to the same sha tag, so the boot-gated and
promoted artifact is content-addressed by rpmdb component and a day-2 update
moves only the changed layers. SOURCE_DATE_EPOCH is pinned on the compose and
the rechunk, and (with the base treefile's __pycache__ postprocess strip) two
identical-source composes chunk to byte-identical layers and seal to an
identical composefs digest. promote's OCI assertion tolerates chunkah's absent
top-level mediaType while still rejecting present-but-non-OCI. New catalog_ref
input (default v9.5.0) fetches the Containerfile.splitter recipe.

First chunked release is a one-time full re-pull per host, then smaller pulls.