fix(images): resolve the base image per distro, not once for the default

Every distribution built FROM `base-debian`, so the arch, ubuntu, fedora and
centos images were all asking the registry for the debian parent.

push.sh exports INFINITO_DISTRO from MATRIX_DISTRO and then sources the env
layer, which is correct as far as it goes: load.sh snapshots caller-set values
and restores them, so the distro survives. INFINITO_PARENT_IMAGE is not set by
the caller, though, and arrives already materialised in .env, rendered for
whichever distro generated that file. Setting the distro in a loop therefore
never reaches the reference derived from it.

The new resolver renders it through utils.distros.base_image() rather than
composing the string, because test_distros_spot rejects an image reference
built anywhere but the SPOT. It sits beside local.sh, ci.sh and service_ref.sh,
which resolve the other image names the same way.

Verified: arch, fedora and ubuntu now resolve to three different parents where
they previously resolved to one. shellcheck is clean and test_distros_spot
passes, which is what proves the resolver stays inside the SPOT.

Not verified: the build step that calls it. push.sh runs only in CI, and the
base images are not published yet, so a real run still stops at the pull before
it reaches this line.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/image/push.sh

@@ -10,6 +10,9 @@ export INFINITO_DISTRO="${MATRIX_DISTRO}"
 # shellcheck source=scripts/meta/env/load.sh
 source "${script_dir}/../meta/env/load.sh"
 
+INFINITO_PARENT_IMAGE="$("${script_dir}/../meta/resolve/image/parent.sh")"
+export INFINITO_PARENT_IMAGE
+
 : "${BUILD_CONTEXT_DIR:?Missing BUILD_CONTEXT_DIR}"
 : "${IMAGE_TAG:?Missing IMAGE_TAG}"
 : "${GITHUB_REPOSITORY:?Missing GITHUB_REPOSITORY}"

scripts/meta/resolve/image/parent.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Output: the distribution base image INFINITO_DISTRO builds FROM, on stdout.
+set -euo pipefail
+
+: "${INFINITO_DISTRO:?Source scripts/meta/env/load.sh or export INFINITO_DISTRO before invoking this script}"
+: "${INFINITO_PARENT_IMAGE_OWNER:?Source scripts/meta/env/load.sh}"
+: "${INFINITO_PARENT_IMAGE_TAG:?Source scripts/meta/env/load.sh}"
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)"
+
+cd "${repo_root}"
+"${PYTHON:-python3}" -c '
+import sys
+
+from utils.distros import base_image
+
+print(base_image(sys.argv[1], owner=sys.argv[2], tag=sys.argv[3]))
+' "${INFINITO_DISTRO}" "${INFINITO_PARENT_IMAGE_OWNER}" "${INFINITO_PARENT_IMAGE_TAG}"