fix(image): preserve active and infrastructure aliases

[stephenlclarke]

Important

All commits in this pull request are signed and verified.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Motivation and Context

During testing of my container-compose plugin, I found and fixed the following issue: image prune --all compared image reference strings to decide whether active containers used an image. Equivalent OCI references can differ after registry and tag normalisation, so prune could treat an active image as unused.

The builder path also stored the configured reference instead of the fetched image reference, and infrastructure-image filters compared configured and stored references literally. Together, these behaviours could expose a normalised builder or init image to list, inspect, delete, or prune operations and could unnecessarily recreate an otherwise matching builder.

Fixes #2030.

Reproduction

1. Configure the stock builder using the equivalent short reference apple/container-builder-shim/builder:0.13.0 with registry.domain = "ghcr.io".
2. Start the system and builder.
3. Pull an unrelated image.
4. Run container image prune --all.
5. Confirm the prune output does not include the builder image and run container builder status.

Before this change, the configured and stored aliases can compare unequal even though they resolve to the same OCI image. The deterministic unit regression models that condition with two references sharing one descriptor digest.

Changes

• Match images used by active containers by OCI digest rather than reference string.
• Match configured builder and init images using original, OCI-normalised, and registry-normalised aliases.
• Store the fetched builder image reference in container state.
• Reuse an existing builder when its stored image reference is an equivalent alias.
• Add focused unit and CLI integration regressions.

Testing

• Tested locally
• Added/updated tests
• Added/updated docs

Documentation is not needed because command syntax and user-facing behaviour are unchanged.

Validation

Validated on macOS 26.5.1 (25F80), Xcode 26.6 (17F113), and Swift 6.3.3 against apple/container main at 27e5043165178edb095c901624857b51a2ea8e1a.

• HAWKEYE_AUTO_INSTALL=1 make fmt
• HAWKEYE_AUTO_INSTALL=1 make check
• HAWKEYE_AUTO_INSTALL=1 make test: 570 tests in 71 suites passed
• swift test --disable-automatic-resolution -Xswiftc -warnings-as-errors --filter 'ImagePruneTests|UtilityTests': 14 tests in 2 suites passed
• Targeted CLI integration:
  • image warm-up: 1 test passed
  • existing image lifecycle suite: 19 tests passed
  • serial image-prune suite: 6 tests passed
  • new testImagePrunePreservesBuilderImage: passed in 45.445 seconds
• git diff --check

The integration regression starts the builder, records its OCI digest, confirms that digest is present in the unfiltered image service, pulls an ordinary unused image, runs image prune --all, verifies the ordinary image is removed, verifies the builder digest remains stored, and verifies the builder remains running.