Test: pin the bake/build metadata file contract with real fixtures

[ianpittwood]

Context

The spike (#728) verified by hand that bakery build --strategy bake --metadata-file and
bakery build --strategy build --metadata-file produce interchangeable files. Nothing in the
test suite pins that: the two shapes are produced by completely separate code paths (raw buildx
passthrough for bake vs. BakeryConfig._merge_sequential_build_metadata_files() at
config/config.py:1116-1126 for build), so they can drift silently and the failure would
surface in CI as a broken bakery ci publish, not as a test failure.

Work

Add real captured metadata files as fixtures — the two files used in the spike are good
candidates:

• a --strategy bake metadata file
• a --strategy build metadata file

for the same set of targets (package-manager 2026.06.0, 6 targets: Standard/Minimal ×
Ubuntu 22.04/24.04/26.04, linux/amd64, built with --push + temp registry).

Add a parametrized test over both fixtures asserting the contract that
bakery dgoss run / bakery ci publish actually rely on:

• MetadataFile.load() validates the file without error;
• the UID key set is identical between the two fixtures;
• for every entry: image_ref is not None, and is of the form <name>@sha256:...;
• for every entry: platform == "linux/amd64";
• for every entry: created_at resolves from the descriptor annotation (not the
  datetime.now() fallback in BuildMetadata.created_at);
• the primary tag (image_tags[0]) matches between the two fixtures per UID.

Sanity-check the fallback paths too, since they are what silently degrade in production:

• an entry with no descriptor platform yields platform is None (the multi-platform
  single-invocation case);
• an entry with no descriptor annotation falls back to the
  label:org.opencontainers.image.created provenance arg.

Acceptance criteria

• Both real fixtures are committed and both validate through MetadataFile.load().
• A single parametrized test enforces the shared contract, so a divergence in either producer
  fails the suite rather than CI.
• Fixtures are documented (in-file comment or docstring) with the exact commands that produced
  them, so they can be regenerated.

[ianpittwood]

Implemented in #733 (commit 98572d44).

• Fixtures committed verbatim as posit-bakery/test/image/testdata/strategy-bake-metadata.json and strategy-build-metadata.json (only renamed; pre-commit's end-of-file-fixer added a trailing newline). Provenance shows commit adec3d9 of images-package-manager; the exact producing commands are documented in the STRATEGY_METADATA_FIXTURES module docstring so they can be regenerated.
• TestStrategyMetadataCompatibility in test/image/test_image_metadata.py covers: loading, UID key set, <name>@sha256:... image refs matching containerimage.digest, platform == linux/amd64, created_at resolving from the descriptor annotation (not the datetime.now() fallback), and cross-strategy agreement on UIDs/tag sets/platform.
• Added test_multiplatform_entry_has_no_platform documenting the index-descriptor degradation, which is the test-side counterpart to the constraint being written up in Clean up build-strategy/metadata docs and help text; document one-platform-per-invocation constraint #739.
• The other two fallback paths named in this issue were already covered: test_created_at_from_build_provenance (annotation missing → label:org.opencontainers.image.created) and test_platform_from_build_provenance_environment (descriptor platform missing → provenance environment). Not duplicated.

uv run pytest test/ -m "not slow and not image_build" → 2070 passed (2058 before).