fix: build legacy image from tracked source only

[Pigbibi]

Scope

• Change only the legacy Docker build context from the authenticated workspace to git archive HEAD.
• Extend the existing shell regression to execute both actual workflow build commands against a synthetic Git checkout. Docker stubs require tar input containing only tracked files; generated gha-creds-synthetic.json must be absent.
• No changes to deployment, traffic, runtime configuration, scheduler, dependencies, or strategy behavior.

Verification

• Actual old-legacy RED: build 2 admits workspace context instead of tracked source.
• GREEN: both real Git archive contexts exclude the synthetic authentication file; existing 6 lifecycle and 21 image-only shell cases pass.
• Related Python tests: 17 passed.
• actionlint, bash syntax, and git diff --check passed.
• No real cloud/provider/broker access or deployment performed. This corrective PR must not trigger deployment or configuration changes.