proverif Wave-3: opam dependency resolution fails (deeper fix — separate PR) #74

Split out of PR #73 by request — this is its own work item / separate PR.

PR #73 ships the safe mitigation only: .containerization/Containerfile.wave3
proverif-builder stage now pins ocaml-base-compiler.4.14.1 + opam update,
and the final copy degrades to a stub if the solve fails (so the image
still builds). Verified by build: opam still emits No solution found, exiting even with the 4.14.1 pin → the stub ships, proverif backend is
non-functional in the image.

Target (where the upstream issue must be addressed)

• File: .containerization/Containerfile.wave3
• Stage: FROM …debian:bookworm-slim AS proverif-builder
• Lines: the opam switch create default ocaml-base-compiler.4.14.1 && opam update -y && opam install -y proverif step
• Upstream: opam default repo snapshot vs proverif 2.x OCaml constraints on bookworm's system opam (2.1.x)

Deeper fix needed (iterative, needs network/opam debugging)

• Determine the OCaml version proverif 2.05.x actually solves against; possibly
  opam repository set-url default https://opam.ocaml.org + a fresh
  opam update, or pin proverif version explicitly, or build proverif from
  its release tarball instead of opam.
• Acceptance: podman build -f .containerization/Containerfile.wave3 --target proverif yields a real proverif -help, not the stub.

Refs #53. Separate PR will reference this issue.