fix: use curl HEAD mode for GHCR probes

[leonfox28]

Failure evidence

The immutable v0.1.0 workflow published the seven deployment/source assets, then all three image jobs stopped before any build or push. GitHub Actions recorded curl exit 18 because --request HEAD changed the method without enabling curl HEAD response semantics. The Release remains an incomplete Pre-release and has no image digest manifest.

Fix

• use curl --head for both authenticated GHCR manifest probes
• require exactly two real HEAD probes and reject --request HEAD in the workflow contract
• record the failure mode in the infrastructure spec and Trellis retrospective
• update public release status and move the install candidate examples to v0.1.1

Validation

• make check-container-files
• go test -count=1 ./internal/containercontract
• make container-config CONTAINER_IMAGE_TAG=dev
• make container-release-bundle RELEASE_TAG=v0.1.1 plus checksum/extracted Compose render
• make check-docs
• make lint
• umask 0022 && CI=true make test
• umask 0022 && CI=true make security
• git diff --check
• redacted worktree, history, and v0.1.1 deployment bundle scans

Release discipline

v0.1.0 will not be moved, rerun, or completed. After this PR passes and merges, publication will use a new v0.1.1 tag on the merge commit. No host preparation, compose up, hardware deployment, or HIL action was performed.