Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

A secrets object with one local name delivered no file. Two requirements could share
a local name. secret recover and the export could not tell two locals apart. The
recipe check missed continued lines and read heredoc bodies as bases. repo:tag@digest
kept the tag in the repository. ask now publishes mandatory, so a tool nothing serves
is said at once rather than after the wait.

internal/builder/mirror_test.go

@@ -208,3 +208,14 @@ func TestAReferenceIsReadTheWayARuntimeReadsIt(t *testing.T) {
 		}
 	}
 }
+
+// `repo:tag@digest` is what a runtime prints; the tag is not part of the repository (review C6).
+func TestATagBeforeTheDigestIsNotPartOfTheRepository(t *testing.T) {
+	got, err := parseReference("quay.io/minio/mc:RELEASE.2025@sha256:abc")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.repository != "minio/mc" || got.reference != "sha256:abc" {
+		t.Fatalf("got %+v", got)
+	}
+}