Equivalence oracle: the GnuCOBOL version every proof compares against is neither pinned nor recorded #4309

Problem

Every equivalence proof (batch, CICS crucible, det ports) compares the Java port against GnuCOBOL running in gitgalaxy-gnucobol:3, built from tests/equivalence/gnucobol.Dockerfile:

FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends gnucobol3 gcc libc6-dev ...

• The base image has a tag but no digest, and gnucobol3 has no version. CI rebuilds the image on every run (.github/workflows/cics-crucible.yml:121).
• gnucobol-db2.Dockerfile builds FROM gitgalaxy-gnucobol:3, so it inherits the same gap.
• No proof records which GnuCOBOL produced its expected results. Locally the image reports GnuCOBOL 3.1.2.0.

Debian stable rarely moves a package's version, so the practical risk today is low. But nothing would detect a change: a rebuilt image, a different base, or a local image built months ago could all produce different oracle behaviour (numeric edge cases, file status codes, collation), and every "proven" claim would silently rest on a different oracle.

Acceptance criteria

• Pin the base image by digest and gnucobol3 to an exact Debian version (or build GnuCOBOL from a pinned source tarball).
• The harness records cobc --version (and the image digest) with each proof result, and fails or warns when it differs from the pinned version.
• Do this before An evidence record per ported program: the claim, the oracle, provenance, approval, staleness #4048 evidence records exist, so the oracle fingerprint in every record is meaningful from the start.

Related: #4048 (evidence record: the oracle fingerprint), #4050 (captured mainframe outputs as a second oracle), #4271 (compiler options).

Found while surveying existing provenance for the #4048 schema (2026-10-04).