fix(oci): derive image ref.name annotation from the pinned FSDK version

[castrojo]

Problem

#34 removed the mutable :latest tag. just tags now emits only the FSDK minor line (25.08) and the immutable point release (25.08.15), plus pre-release/beta tags; the local build/verify/push recipes use a private, never-published local_tag := "build".

Every OCI assembly element still hardcoded:

'org.opencontainers.image.ref.name': 'ghcr.io/projectbluefin/<name>:latest'

So every published image carries a standard OCI annotation that self-describes it with a reference resolving to nothing. Any consumer or tool that trusts org.opencontainers.image.ref.name gets a dead pointer.

Fix

Substitute %{fsdk-version} — the exact pinned FSDK point release:

'org.opencontainers.image.ref.name': 'ghcr.io/projectbluefin/base:%{fsdk-version}'

This is the same value just tags emits as the immutable tag and the same value the org.opencontainers.image.version label already carries (Justfile:196), so the annotation is consistent with the rest of the OCI metadata.

The value comes from include/fsdk-version.yml, which just bst regenerates on every invocation from the pinned ref: in elements/freedesktop-sdk.bst (gitignored, never hand-edited). This is the mechanism elements/podman-vm/podman-vm-efi.bst already uses; the OCI elements now include it alongside the existing include/slim.yml:

variables:
  (@):
    - include/slim.yml
    - include/fsdk-version.yml

It cannot drift. A version bump updates the annotation automatically — no checklist step, no hardcoded literal.

Options considered and rejected

• Remove the annotation. Honest — one image manifest is published under several tags, so no single tag is "the" ref name — but it drops metadata some tooling reads, and the point release is genuinely the most precise published name for that manifest.
• Hardcode the minor line (:25.08). Goes stale when the FSDK minor line moves, and being a literal in a .bst file it becomes another thing the version bump must remember — exactly the failure mode that produced this bug.
• Point release, hardcoded. Same drift problem, worse (stale every point release).

The dynamic point release wins on all axes: immutable, always published, always correct.

Scope

All seven elements that carried the annotation — base, static, skopeo, lab-runner, python, buildah, qemu-img. elements/oci/brew-nspawn.bst sets no index-annotations and is untouched.

Docs updated so the next image does not reintroduce the bug:

• docs/skills/add-new-image.md — documented setting the annotation to a literal tag (:build); now documents the substitution and the required variable include.
• docs/skills/container-standards.md — records that ref.name is derived, never hardcoded, never :latest.
• docs/skills/bump-fsdk-version.md — states the bump needs no edit to the annotation.

Verification

Verified:

• just validate passes — the full element graph (all OCI targets + podman-vm/podman-vm-efi.bst) resolves with the added variable include.
• The substitution resolves to the intended value. just bst show --deps none --format '%{config}' oci/base.bst oci/python.bst renders:
  • 'org.opencontainers.image.ref.name': 'ghcr.io/projectbluefin/base:25.08.15'
  • 'org.opencontainers.image.ref.name': 'ghcr.io/projectbluefin/python:25.08.15'
    which matches just tags output (25.08 / 25.08.15).

NOT verified by building: no full image build was run, so the annotation was not read back out of a produced OCI index with skopeo inspect. The build-oci heredoc is passed through verbatim by the script element, and the rendered command above is exactly what build-oci receives, so the only unverified step is build-oci's own handling of index-annotations — unchanged by this PR.

Nothing in this repo reads org.opencontainers.image.ref.name (no just verify gate, workflow, or test references it), so no in-repo consumer breaks. .pre-commit-config.yaml does not exist; nothing to run.