That allows fully pinning stable branches to a given set of dependency so that CI stability is not affected when new software is released (e.g., distro releases, python releases).

There was a first attempt to do that upstream:
https://mail.openvswitch.org/pipermail/ovs-dev/2023-November/409482.html

However, that was nacked because it was making the development procedure too complicated.

Based on follow up discussions a potential solution involves:
a. build the container image on every push on stable branches
b. change the cirrus-ci image to ubuntu-aarch64 (fedora-aarch64 takes ~1h to build)
c. keep the weekly job that builds the container image on main (this is useful for downstream CI too)
d. (optional) the push workflows on the main branch should use the pre-built image