ci: build image once with consistent deps + sync go.sum

[entlein]

Summary

Two coupled fixes so node-agent CI actually builds:

1. go mod tidy: go.sum had been left at the March 11 storage SHA. After the storage replace was bumped (commit `7948db79`) without a tidy, all builds fail with "missing go.sum entry" (the `Build sign-object image` workflow on `main` is currently red for this).

2. `component-tests.yaml` — image and test runner now compile against the same storage SHA:

   • `STORAGE_REF` default: stale March 11 SHA → empty + `git ls-remote ... main` resolution at runtime.
   • New `Resolve storage ref` step in `build-and-push-image` outputs the SHA once; `component-tests` consumes it via `needs.build-and-push-image.outputs.storage_ref`.
   • New `Pin storage version for image build` step runs `go mod edit -replace ... && go mod tidy` before `make docker-build` (previously only the test runner did this — image and tests compiled against different storage versions when go.mod replace drifted).
   • Image tag: `test--s` so a given (node-agent, storage) pair always produces the same artifact and is cacheable.

Test plan

• Local `go build ./...` clean (verified)
• Local unit suite passes (verified, randomx ignored)
• `Build sign-object image` workflow goes green on this branch
• `Node Agent Component Tests` workflow goes green when dispatched against this branch

🤖 Generated with Claude Code