The control plane's recipe starts FROM the base its manifest declares, and an undeclared base is refused

The mesh's own images declare theirs now, so the refusal ADR 0097 deferred is live.
The builder's own image and the examples take arguments with defaults; make builds
them, not the mesh.

Dockerfile

@@ -1,3 +1,4 @@
+ARG GO_BASE=golang:1.25-alpine
 # The control plane's image.
 #
 # novox/hq ADR 0006: this image is pinned by digest in the bundle the host carries, fetched on a
@@ -11,7 +12,7 @@
 # (novox/hq ADR 0004). Adding them "just in case" would put a trust store in the one image whose
 # whole argument is that it contains nothing to reason about.
 
-FROM golang:1.25-alpine AS build
+FROM ${GO_BASE} AS build
 WORKDIR /src
 
 # Dependencies first, so a change to the source does not refetch them.