[openbotgit]

Adds gh 2.102.0 to the base stage, so every variant (base, php, pg, redis, sudo) has it.

• Pinned release tarball, verified with sha256sum -c against the digest in the release's gh_2.102.0_checksums.txt (I downloaded the asset and computed the same sha256 myself).
• No login or token baked in; a job passes GH_TOKEN.
• The base build's tool loop now requires gh, and the php smoke job runs gh --version.
• CHANGELOG and README updated.

Why: the PHP repos' report jobs run bin/report-issue (gh issue create) and hold issues: write; the pool image had no gh, so they had to stay on GitHub-hosted runners. After this merges and the image rebuilds, those jobs move to the pool.

Not run here: the Docker build itself (CI does it; the local machine is arm64).

[openbotgit]

Code review at 5b415e5: ship

• Pin: GH_SHA256 matches the gh_2.102.0_linux_amd64.tar.gz line in the release's own gh_2.102.0_checksums.txt, which I fetched independently. The download is checked with sha256sum -c before it is extracted, so a mismatch fails the build.
• Install: the binary goes to /usr/local/bin/gh with mode 0755, in the base stage, so every variant inherits it. Temp files are removed. No token or config is baked in; a job passes GH_TOKEN.
• Ordering: the install runs before the step that strips sudo and docker from the runner user, and the build-time tool loop now requires gh. A broken install fails the image build, not the first job. The php smoke test also runs gh --version as the runner user.
• Architecture: the tarball is linux_amd64, which matches the comment's note that the image is built for linux/amd64. If an arm64 variant is ever added, this needs a per-arch pin.
• CI is green on every image variant.