versions: an image's pin is asked of its registry, not of docker

[aledbf]

ami's first weekly refresh (refresh.yml) failed on versions bump go: on the Blacksmith runner docker buildx imagetools inspect --format '{{.Manifest.Digest}}' printed its whole listing, and that became the pin (the pin "Name: mirror.gcr.io/library/golang:..." is not a sha256: digest).

resolve now asks the registry itself with go-containerregistry's crane.Digest (already in the module graph, now direct), using the same keychain docker reads (~/.docker/config.json, credential helpers). It returns the digest of what the tag names: for a multi-platform image the index, which is what was pinned before.

Checked:

• task test and task lint. The test runs a registry in-process (pkg/registry, plain HTTP for a localhost reference): a missing tag is an error, and a tag's pin is its index's digest, not another tag's.
• task mutate BASE=origin/main: 0 survived.
• Against the real registries, with ami's versions.yaml: bump go and bump wolfi-base give the same digest as before, and bump python gives the one versions check reported.

Followup: ami bumps go-tools to this and dispatches Refresh again.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}