security: pin p2pool source commit, digest bases, trivy/SBOM/cosign gate, compose loopback

[sethforprivacy]

• Pins p2pool v4.18 to commit 1748daae... with a rev-parse equality assertion (build fails on tag/commit mismatch; ARG keeps the _COMMIT_HASH suffix so Renovate's customManager regex still bumps branch + pin together).
• Digest-pins ubuntu:26.04 (latest LTS) on both stages (sha256:2260313b..., same digest as the hardened bitcoind/litecoind images). Package set verified live against the 26.04 base: all runtime t64 names still exist; build-stage libidn2-0-dev renamed to libidn2-dev (updated accordingly).
• Adds HEALTHCHECK (TCP connect to stratum 3333); ports trivy CRITICAL/HIGH gate, provenance + SBOM, cosign keyless signing, digest-first push from the monerod repo.
• examples/docker-compose.yml: monerod restricted RPC 18089 + ZMQ 18083 loopback-bound only.
• Adds .dockerignore; removes dead .github/containerscan; fixes README badges/claims.
• Verified: docker build --check clean; YAML parse; bash -n; digests + SHAs resolved live from registry/GitHub APIs; apt-cache package probe run inside ubuntu:26.04@2260313b. Source build not run locally (heavy).