The clean rebuild re-pulls python:3.12-slim (now Debian trixie) whose apt layer
fails on erable's old Docker. Document the pin-the-digest fix and the
source-only overlay-build shortcut so the next deploy doesn't rediscover it.