ci: harden chronicle-image-pin-gate (64-hex digest + self-test)

[devkoriel]

What

Hardens chronicle-image-pin-gate to flag every unpinned/malformed chronicle image form, and adds an embedded self-test so the detector cannot silently regress.

Why

The first version had narrow false-passes: a chronicle ref ending in @sha256:<short-or-invalid-hex> (e.g. @sha256:abc) passed, and the malformed @sha256- hyphen form (the cosign sig-tag shape behind the 06-22 archiver incident) was only caught by accidental truncation. "Pinned" must mean a real multi-arch index digest, not any @sha256: substring.

How

• Detector captures the whole ref token and requires @sha256: + EXACTLY 64 lowercase-hex chars. It now flags bare semver, git-sha tags (sha-xxxxxx), :latest, no-tag, the @sha256- hyphen form, and short/over-long/invalid digests; it passes only genuine 64-hex digests.
• An embedded 10-case self-test runs before the gate and fails the job if the detector regresses.

Validated locally: 10/10 self-test cases pass; the gate flags an unpinned render and passes pinned ones.