feat: pin every module image by digest, and give 8 games a version list

[ValgulNecron]

Why

Every one of the 16 modules shipped a floating default image (13 a bare :latest), so a pod restart could swap the game binary under a live world with no version bump and no changelog. That is not hypothetical — passivelemon/terraria-docker:terraria-latest moved from Terraria 1.4.4.9 to 1.4.5.6, changed the network protocol, and broke the e2e Terraria bot.

Separately, 9 of 16 modules declared no spec.versions at all, so those games offered users no version choice whatsoever: the Create Server wizard skips its version step when spec.versions is empty, and Settings → Version had nothing to switch between.

Closes the "hermetic module images" item on Gameplane's roadmap to v1.

What changed

Pinning engine (validate.py)

• resolve_digest() returns the digest of the tag manifest — a multi-arch index digest where upstream publishes one. Deliberately not the per-platform digest fetch_image_config drills down to: pinning that would cut each module to a single architecture and break the arm64 half of the e2e matrix. Verified itzg/minecraft-server:java21 pins to an OCI index covering linux/amd64 + linux/arm64.
• Registry auth is now the standard OCI bearer challenge, so any registry resolves rather than only Docker Hub. dayz (on a self-hosted GitLab container registry) was previously skipped by every rule; it is now fully checked and pinnable, and validates clean.
• _parse_ref handles digest refs. It previously left the tag glued to the repo path for repo:tag@sha256:…, and left the registry host on the repo for non-Docker-Hub refs — both would have 404'd every request built from them. Neither could surface before, because both paths were unreachable.

New rule 10 (rule_images_pinned) draws the line at defaults:

• ERROR on an unpinned spec.image or an unpinned default: true version — what a server runs when the user expressed no preference.
• WARN on any other unpinned version entry, since a module may legitimately offer a moving channel the user picks by name.

It is pure string inspection with no registry call, so a network blip can never downgrade it the way the image-exists rules deliberately degrade.

validate.py --pin rewrites templates to the readable repo:tag@sha256:… form, line-wise so the templates' extensive comments survive (a YAML round-trip would discard them), and leaves any ref it cannot resolve untouched rather than inventing a digest.

Version lists added to 8 modules. displayNames say "image release" rather than naming a game version wherever the tag is the wrapper's version — following the convention palworld already set with "v2 wrapper (major line)". enshrouded is the exception: its tags really are game versions.

Deliberately floating, marked # gameplane:floating: factorio's "Experimental channel" and terraria's "tModLoader latest preview" — image-carried pre-release channels whose purpose is to track upstream, both non-default, so drift is only ever the user's explicit labelled choice.

garrys-mod deliberately gets no version list. Its only non-latest tags are base-OS variants (debian/ubuntu/-root), which are a packaging choice rather than a version; modelling them as versions would misuse the field.

Monthly refresh-pins.yml re-resolves every pinned tag and opens a PR. It never pushes to main and never auto-merges — a pin refresh means the game binary changes for everyone on next restart, which is exactly the event pinning exists to put a human in front of.

Verification

• python3 validate.py across all 16 modules: 0 errors (3 clean, 13 warn-only). The remaining warnings are the pre-existing puid-image-needs-fsgroup set plus the two intentional floating-entry warnings.
• The new rule was observed failing on the unpinned templates before the pin commit and passing after, so the gate is proven live rather than assumed.
• --pin is idempotent: a second run reports "already pinned / no change" and respects the floating markers.
• Every template still parses; the version-list commit is purely additive (no deletions).