ci: generate incorporation with pkg list -n instead of *@latest (#8185)

this is exactly the change @citrus-it suggested in issue #8176.

`pkg list -g ...` as used in creating an incorporation to lock
packages implies `-a`,
```
           -g path_or_uri
                   Use the specified package repository or archive as the
                   source of package data for the operation.  Repositories
                   that require a client SSL certificate cannot be used with
                   this option.  This option can be specified multiple times.
                   Use of -g implies -a if -n is not specified.
```
where `-a` is:
> List installed packages and list the newest version of package that
are not installed but could be installed in this image.

this wasn't super clear about what happens if a package is both
installed and a newer version of that package is available, but it seems
in practice the answer is "list the installed version, not a new
version". in the case of a package like `/system/kernel`, that's already
installed (surprise), carrying on through to more visible packages like
`consolidation/osnet/osnet-incorporation`. so, it's less that Helios was
pinned as much as we were very committed to whichever bits are present
when a TUF is built.

`-n` as Andy suggested always shows the newest version of packages,
avoiding... this. passing `-af` with an FMRI of `*@latest` might also
do, but `-n` seems more straightforward.

Author: iximeow

dev-tools/releng/src/helios.rs

@@ -131,7 +131,7 @@ set name=variant.opensolaris.zone value=global value=nonglobal
 
     let stdout = Command::new("pkg")
         .args(["list", "-g", HELIOS_REPO, "-F", "json"])
-        .args(["-o", "fmri", "*@latest"])
+        .args(["-o", "fmri", "-n", "*"])
         .ensure_stdout(&logger)
         .await?;
     let packages: Vec<Package> = serde_json::from_str(&stdout)