Thanks for the review. I still need to figure out how to test whether this will break external CI or not (and document or automate that workflow), but will merge as soon as I'm convinced.

(External CI is not running with the new build image.)

So I can locally check this, but the way we're handling the docker containers at the moment means we are not going to be continuously checking that dropping 2.6.2 and adding 2.6.3 works for everything until after the next release. So we run some risk (if the new prover version contains regressions or soundness fixes) of breaking CI on main after release due to a change we're making now.

We could accept this. Or we could actually look into ghcr's image retention policies and see if you can configure that correctly to allow us to push new containers on every push to main without blowing out of our quota or whatever.