role_scan: credit container-template stream pins

[ideaship]

Problem

role_unpinned reports cephclient (reef) and openstackclient
(2024.2) as actionable drift — role-default <alias>_tag pins with no
canonical release pin. These are false positives.

Both tags are stream-wired in the authoritative container render
template (container-image-osism-ansible/.../images.yml.j2):

cephclient_tag:     "{{ cephclient_version|default(ceph_version) }}"
openstackclient_tag: "{{ openstackclient_version|default(openstack_version) }}"

i.e. the release train governs the deployed tag (concrete pins live in
the train files ceph-*.yml / openstack-*.yml), and the role default
is only a fallback. But iter_role_pins() decided stream-resolution by
reading only the generics manager template
(generics/environments/manager/images.yml), which omits these two
aliases — so their role defaults were treated as canonical role pins.

Fix

Union the stream-resolved set from the container template on top of the
generics one in iter_role_pins(). From the real container template
this adds exactly cephclient and openstackclient (nothing else
matches the <name>_version|default shape). role_shadows shares
iter_role_pins() and benefits identically.

Also declare the container template in role_unpinned's INPUT_FILES:
the driver resolves source repos from each selected plugin's
INPUT_FILES, so without it, running role_unpinned alone in remote
mode would read an unresolved repo. role_shadows already declared it.

Verification

Against the local checkouts: role_unpinned drops from 11 to 9
actionable findings (cephclient and openstackclient removed);
role_shadows unchanged. Two new tests (a role stream-wired only in the
container template must not surface as unpinned; role_unpinned must
declare the container template as an input). Full suite 333 passed;
black + flake8 clean.

[ideaship]

Closing as superseded — the root cause is better fixed upstream.

This PR suppressed the role_unpinned false positive for cephclient/openstackclient by treating them as stream-resolved and skipping them in iter_role_pins(). That works, but "skip these aliases" also hides genuine shadowing drift — which is exactly how the openstackclient role default (2024.2) had been silently lagging the deployed series (2025.1) unnoticed.

The follow-up fixes the actual cause instead:

• openstackclient,cephclient: track deployed series ansible-collection-services#2135 — default the role vars to the deployed series (openstackclient_version: "{{ openstack_version }}", cephclient_version: "{{ ceph_version }}").

With that, the role no longer holds a static literal, so:

• role_unpinned drops the two aliases on its own (verified 11 → 9) — the dynamic value isn't a concrete role pin, so it's not flagged;
• the staleness is structurally gone (nothing to drift); and
• the detector stays honest — if a hardcoded literal is ever reintroduced, it's flagged again, rather than being permanently silenced by an alias skip.

So this change is no longer needed and would only add a permanent blind spot. Superseded by #2135.