`orchestration/runtime/bootstrap/Containerfile` downloads crates without cryptographically verifying their integrity

[kayabaNerve]

This is due to an issue with the packaging performed by StageX, the distribution used within the Containerfile. We can work around it by vendoring accurate lockfiles ourselves.