Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

A secrets object with one local name delivered no file. Two requirements could share
a local name. secret recover and the export could not tell two locals apart. The
recipe check missed continued lines and read heredoc bodies as bases. repo:tag@digest
kept the tag in the repository. ask now publishes mandatory, so a tool nothing serves
is said at once rather than after the wait.

internal/builder/mirror.go

@@ -52,6 +52,11 @@ func parseReference(ref string) (upstream, error) {
 	name, reference := ref, "latest"
 	if at := strings.Index(ref, "@"); at >= 0 {
 		name, reference = ref[:at], ref[at+1:]
+		// `repo:tag@digest` is what a runtime prints; the digest names the image and the tag is
+		// only what it was called. The tag is not part of the repository.
+		if colon := strings.LastIndex(name, ":"); colon > strings.LastIndex(name, "/") {
+			name = name[:colon]
+		}
 	} else if colon := strings.LastIndex(ref, ":"); colon > strings.LastIndex(ref, "/") {
 		name, reference = ref[:colon], ref[colon+1:]
 	}