fix(bench): pin the AMI and record the binary that moves dregsy's bytes

[bryantbiggs]

Two inputs still moved between otherwise identical instance rebuilds, so a benchmark shift could not be attributed to a change here.

The AMI was resolved with most_recent over the release prefix al2023-ami-2023.*-x86_64. AL2023 publishes several kernel variants under one release with near-identical creation timestamps, so that was not merely tracking the newest release, it was selecting between kernel 6.1, 6.12 and 6.18 arbitrarily. Kernel, glibc and NIC driver were all outside operator control on a network-bound benchmark. It now pins an exact image name, verified to match exactly one image in the region.

AWS deprecates AL2023 images after roughly three months and hides them from describe-images, so this pin eventually stops resolving and apply fails. That is intended. The failure is the prompt to move to a current image, rather than keep launching one with unpatched kernel and glibc updates, and the comment says so.

dregsy transfers nothing itself. Its generated config sets relay: skopeo, so skopeo moves every byte dregsy is credited with, and a skopeo bump shifted dregsy's numbers with nothing in the record to explain it. Relay binaries are now probed and recorded alongside the tool that delegates to them, and a relay failing its probe is an error, since it is as load-bearing as the tool itself.

Relay versions are kept in their own field rather than added to tool_versions. That map's keys drive the metric table columns, and a relay is never benchmarked, so reusing it would have rendered an empty skopeo column in every table. A test asserts the separation, kill-tested by feeding relay keys into the column list and confirming it fails.

CI is the gate for this one. Locally cargo fmt, clippy -D warnings, terraform fmt and terraform validate pass, and all 144 xtask tests pass. The eight testcontainers-backed integration tests in ocync-distribution currently fail on my machine with WaitContainer(StartupTimeout), which is container startup rather than an assertion, and this diff touches only bench/ and xtask/ so it cannot reach that crate. I have not proven the failure is environmental, so it wants a clean CI runner to confirm rather than my say-so.