Refresh BCI minimal base to 15.7-26.60

[ai-collaboration-app]

Refresh BCI minimal from 15.7-26.58 to 15.7-26.60 and align the OCI base label. This supported SUSE 15.7 refresh preserves UID 1001, the shell/coreutils copy contract and all StackPack source content. No custom package installation or content version bump is needed.

Signed source head: 4860675d7102d1b359358617e0d2e29ed602dfd5. The CI synthetic merge 1177d894ba0465b8224c4a239f474788475f5a6c has the same source tree.

Validation:

• Candidate CI passed all three StackPack validation/package/version checks, image smoke test, Trivy vulnerability/secret and Grype gates, and amd64/arm64 publication. No local exception path was supplied. Chart dispatch was correctly skipped for this PR.
• Signed raw candidate evidence records fresh local scans of both published architectures: zero Trivy vulnerabilities/secrets and zero Grype matches/ignored matches, without VEX or exceptions. Both inventories contain glibc 2.38-150600.14.58.1 and libpcre2-8-0 10.42-150600.3.3.1, retaining the previously refreshed ACL, attr and bzip2 packages.
• Published amd64 passed the chart copy script at UID 1001 with read-only root, dropped capabilities and no-new-privileges: stale-file removal and checksums of all three copied packages passed. PR22 package artifacts also passed this test in a local candidate build. Native arm64 runtime execution was not tested.
• Repository pre-commit checks, including zizmor, passed. PR22's earlier clean scan remains historical evidence only.

Published candidate: quay.io/stackstate/contrib-stackpacks:20260919085222-refresh-bci-minimal-pcre2-glibc-1177d89.

Identity	SHA-256
Multiarch index	8b8d99fe3f5b24b0d21bf715efd7bbb8f6895cbd375ce7668d44a3bf6b36c1ee
amd64 image manifest	c9cac839eb8e2de091b4ee0d40ef64f7309f7818b1a62a693475a710d583ccda
arm64 image manifest	f0cb0b68321baacc40e265d9a9ab8b0c32a9dc1a5be8b5853daa0b873c1368bc
BCI base index	fecc13ede4c24c1bc7d4b0131f5396b8d226d15b38d83bedb21474f349872f9f

Human review/merge and main publication are pending. After approval, main CI publishes a new main tag and dispatches chart Updatecli. Adoption must update stable/suse-observability/values.yaml, stackstate.stackpacks.images[1].tag in helm-charts-internal from 20260916122047-main-1502a2f to that new main tag. The Updatecli filter selects main tags, so this branch snapshot is not a production adoption target. Chart approval/publication and a later delivery scan remain required; this PR does not establish clean production delivery.