Merge branch 'maint'

Carries today's maint batch: the local CI image-scoping work, which gives
each run its own build context and test image tag instead of writing the
shared mutable one, and the retirement of the bloom-storm chaos scenario.

Both apply unchanged here — the compose files, suite lists and matrix legs
they touch are identical on the two lines, so no branch adaptation was
needed. Parity stays symmetric across runners at 21 legs a side on this
branch and 24 on maint, the gap being the three rekey Docker suites maint
keeps by design.

.github/workflows/ci.yml

@@ -65,6 +65,8 @@ jobs:
         run: python3 testing/check-log-strings.py
       - name: Check no tested function's exit status is a log call's
         run: python3 testing/check-trailing-log.py
+      - name: Check nothing resolves the shared mutable test image
+        run: bash testing/check-image-scoping.sh
       # Hermetic: synthetic ping functions, no containers, ~45s. Lives beside
       # the other two so both runners gate on it identically — putting it in
       # only one would create exactly the drift check-ci-parity.sh exists to
@@ -438,9 +440,6 @@ jobs:
           - suite: congestion-stress
             type: chaos
             scenario: congestion-stress
-          - suite: bloom-storm
-            type: chaos
-            scenario: bloom-storm
           # ── Sidecar deployment ──────────────────────────────────────────
           - suite: sidecar
             type: sidecar