fix: match a promoted image to its release by digest

[cplieger]

Summary

• examples/images/verify.sh and its copy in docs/images.md: a promoted stable release's tag names a later commit than the image it publishes, so the lookup by the image's source commit found no release and skipped the release-file check. The lines now pick the stable release whose tag names the same image digest, verify the release file's signature, and compare its package names and versions with the list signed into the image. Metadata a scan rewrites (date, document name, scanner version, references) is not compared.
• The prose says a promoting release attaches the list signed into the image, and that a release made by an older workflow scanned the image again.
• tests/images/verify.sh derives every case from live releases: a promoted release matched to its own file, an older major never matched with the newest release, a moved tag, a restored file, another release's file refused, a re-scan accepted and a changed package version refused.

This turns the Examples images job green again; it has been red on main since 2026-10-10.

Testing

• bash tests/images/verify.sh against live GHCR and Sigstore: 17 checks pass. This host has no Docker, so a stand-in answered docker buildx imagetools inspect from the registry API; CI runs the real one.
• Mutants of the lookup and the comparison each turn the targeted cases red.
• scripts/snippets.py --check, shellcheck and shfmt are clean.