chore(docker): pin Clam and its three dependencies to SHAs

[GuilhermeBn198]

Why

Dockerfile.dev built Clam from four repositories, all of them tracked on moving branches:

repo	branch	pinned SHA	branch tip when pinned
seahorn/clam	dev16	302bf49a	2026-08-07
seahorn/sea-dsa	dev16	661855a3	2026-08-12
seahorn/llvm-seahorn	dev16	8e7e6c62	2026-07-04
seahorn/crab	dev	5c740fcc	2026-08-21

So the contents of the published image could change with no change in this repository. That is not hypothetical: crab@dev moved one day before this was written, and #58 was a red develop caused by a Clam build nobody had touched. Pinning turns an upstream break into a deliberate bump with a diff, instead of a build that worked yesterday and fails today for reasons no diff explains.

Follow-up to the item flagged in #58.

How

Clam's crab and extra targets are plain git clone -b dev<N> custom commands (cmake/{crab,seadsa,llvm-seahorn}-git.cmake) with nowhere to pass a commit — pinning means not using them. Clam's CMakeLists.txt already prefers a dependency found in-tree over cloning one, so all four are placed by hand at their pinned SHAs.

Two things fall out of that:

• git init + fetch --depth 1 <sha> instead of clone -b <branch> — the only shallow form that takes a commit, so pinning costs no extra history.
• Because every dependency is in place before the first configure, the cmake → --target crab → cmake → --target extra → cmake dance collapses to a single cmake ...

The SHAs are ARGs, so a bump is a one-line diff, and the comment above them says how to do it.

Verified before pushing

Ran the pinned layout and configure inside the image (-u 0 --cpus=2, exit 0):

-- Clam: including llvm-seahorn
-- Compiling sea-dsa without sanity checks
-- Crab: libraries and dependencies are built statically
-- Configuring done
-- Generating done

All four checkouts resolve and one configure detects sea-dsa, Crab and llvm-seahorn — no required but not found, which is what the previous unpinned recipe emitted before its first two targets ran.

The Build & Push to GHCR job added in #58 builds this PR's Dockerfile.dev with push: false, so the full compile and the verifier.assume injection probe are checked here, pre-merge.