ci(abi): run Idris2 type-check in the pinned idris2-pack container

The idris-typecheck job failed on main: idris2 is not in Ubuntu's apt
repos (E: Unable to locate package idris2), so it never type-checked the
model — leaving the Types.idr/Foreign.idr changes machine-unverified.

Run the job inside ghcr.io/stefan-hoeck/idris2-pack (the community-
standard image, ships idris2 + base), pinned by sha256 digest. Includes a
refresh command in a comment for future digest bumps.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TaWWedv6VQqeZaPvc94keN

Author: claude

.github/workflows/abi-contract.yml

@@ -56,13 +56,19 @@ jobs:
     name: Idris2 model type-checks
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    # idris2 is not packaged for Ubuntu; run inside the community-standard
+    # idris2-pack image (ships idris2 + base), pinned by digest. Refresh the
+    # digest with:
+    #   curl -sSL "https://ghcr.io/token?scope=repository:stefan-hoeck/idris2-pack:pull" \
+    #     | sed -n 's/.*"token":"\([^"]*\)".*/\1/p' | xargs -I{} \
+    #     curl -sSI -H "Authorization: Bearer {}" \
+    #     https://ghcr.io/v2/stefan-hoeck/idris2-pack/manifests/latest | grep -i docker-content-digest
+    container:
+      image: ghcr.io/stefan-hoeck/idris2-pack@sha256:370e2ab066251cf278ac6928d9201ade0aca70c4e7ee1cc434d25bcea1669b29
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Install Idris2
-        run: sudo apt-get update && sudo apt-get install -y idris2
-
       - name: Type-check the ABI package
         working-directory: src/interface/abi
         run: idris2 --typecheck gsa-abi.ipkg