feat(build): make the user-modpack build lane read its context (closes the last functional gap)

A submitted modpack was durable but unreadable: the uploads PVC cannot cross
namespaces (felis-api mounts it; Kaniko runs in felis-build) and the s3 lane
handed the sandboxed build Pod no credentials, so NO user build could ever
consume its context. The transport is now the API itself:

- submit: derived context refs become the internal-face URL
  /api/v1/internal/submissions/{id}/context (service-token gated), and Blobs
  gains Open (local + s3) with an ErrBlobNotFound sentinel for the route's 404.
- api: serves that route on the internal face only (openapi.yaml updated; the
  route-coverage test enforces it).
- build: an http(s) context renders a context-fetch initContainer (the felis
  image's new fetch-context entrypoint) that streams the blob with the
  namespace-local service-token Secret — never mounted into Kaniko — and
  extracts it under a zip-slip guard into a size-limited emptyDir that Kaniko
  reads read-only as --context=/context.
- platform/install: the api Deployment carries its own internal base URL; the
  build namespace gets the token Secret through the existing replica mechanism
  (bootstrap.sh + felis setup); the build egress lock opens exactly the control
  namespace on the internal port.
- cmd/felis: fetch-context entrypoint (registered, documented, unit-tested for
  escapes/symlinks/non-gzip).

Tests cover rendering, hardening, the s3/local Open paths, and the route's
404/503 mapping. Verified next on the real single-node cluster with Kaniko.

internal/build/build.go

@@ -215,6 +215,11 @@ type Config struct {
 	// RegistryURL is the internal registry the build pushes to and Trivy scans
 	// (spec §17). Image refs are validated to be under it.
 	RegistryURL string
+	// FelisImage is the platform image whose `fetch-context` entrypoint streams a
+	// submission's context from the internal face into the build Pod. Required
+	// only when a build's ContextRef is an http(s) URL (the submit lane's derived
+	// shape); an install that never builds user submissions can leave it empty.
+	FelisImage string
 	// KanikoImage / TrivyImage are the executor images.
 	KanikoImage string
 	TrivyImage  string
@@ -355,6 +360,7 @@ func (b *Builder) jobParams(bld *Build, cfg Config) JobParams {
 		Namespace:      cfg.Namespace,
 		ServiceAccount: cfg.ServiceAccount,
 		RegistryURL:    cfg.RegistryURL,
+		FelisImage:     cfg.FelisImage,
 		KanikoImage:    cfg.KanikoImage,
 		TrivyImage:     cfg.TrivyImage,
 		Deadline:       cfg.Deadline,