[minor] Adopt versioned OJS application image

[pennypacker-he]

Summary

• move the OJS 3.5.0-5 release into the published Buildkit image and keep the template Dockerfile as the downstream customization layer
• make OJS setup and migration bounded and fail-hard while preserving generated application-key and file-volume state
• align one-shot database initialization, env-driven runtime settings, and immutable multi-architecture dependency digests

Validation

• docker compose config --quiet
• Buildkit hosted image tests, real HTTP check, and coordinated sitectl create smoke: https://github.com/libops/buildkit/actions/runs/29165298540
• this PR runs the OJS template smoke on GitHub Actions