Decide whether ww-master application content must be CID-pinned

[lthibault]

The ww-master image is pinned by immutable OCI digest, but its optional application root is currently an /ipns/.../examples/snap-hello-rs path. The same runtime image can therefore serve different application content as IPNS changes.

Decide and document the intended product contract:

• pin this application root to a CID for release reproducibility; or
• retain mutable IPNS content intentionally, with an operator-visible resolved CID and an explicit statement that OCI digest alone does not identify the full served application.

Acceptance criteria:

• an explicit choice is recorded;
• deployment configuration and verification enforce or expose that choice;
• rollback guidance describes the resulting behavior.