Remove an image's pushed names with its build tag, and take no work under the free-space floor (issue 1834)

The registry push tags the image a second time, so removing only the build tag freed nothing.
The held image a comparison pulls goes after it is read, and a node under the floor leaves the ask
to another build node instead of taking it and failing.

internal/builder/disk_1834_test.go

@@ -133,18 +133,26 @@ func TestTheThrowawayStoreIsNotStartedWithRm(t *testing.T) {
 // 1834/AC1: given an image built for a check or a walk and published to the registry, when the build ends, then the
 // local image tag, the narrowed source and the context clone it left are gone; an image published nowhere (a mesh
 // being raised) is kept, since it is the artifact.
+// pushedNamed is a publisher that tags the image as <registry>/<repository> to push it, as the registry one does.
+type pushedNamed struct{ *recorded }
+
+func (pushedNamed) PushedNames(repository string) []string {
+	return []string{"registry.invalid/" + repository}
+}
+
 func TestABuildRemovesWhatItLeftOnTheNode(t *testing.T) {
 	r := &recorded{
 		contents:  map[string]string{"modules/m/" + ManifestName: anImageWithAContext, "modules/m/Dockerfile": "FROM scratch\n"},
 		secondary: map[string]map[string]string{"https://forge.invalid/ctl.git": {"go.mod": "module x\n"}},
 	}
 	workspace := t.TempDir()
-	if _, err := Build(context.Background(), r.run, r, "https://forge.invalid/c.git", "modules/m", "", workspace, nil, Npmrc{},
+	if _, err := Build(context.Background(), r.run, pushedNamed{r}, "https://forge.invalid/c.git", "modules/m", "", workspace, nil, Npmrc{},
 		GitCredential{}, nil); err != nil {
 		t.Fatal(err)
 	}
-	if !strings.Contains(strings.Join(r.ran, "\n"), "docker rmi m-server:c0ffeec0") {
-		t.Errorf("the image built for it was not removed: %v", r.ran)
+	// Both names go in one rmi: the layers stay while either is left (the push tagged the image with the registry's).
+	if !strings.Contains(strings.Join(r.ran, "\n"), "docker rmi m-server:c0ffeec0 registry.invalid/m/server") {
+		t.Errorf("the image built for it and its pushed name were not removed: %v", r.ran)
 	}
 	left, _ := filepath.Glob(filepath.Join(workspace, "*"))
 	if len(left) != 0 {
@@ -172,3 +180,37 @@ func TestAnImageKeptLocallyIsNotRemoved(t *testing.T) {
 		t.Errorf("the artifact of a mesh being raised was removed: %v", r.ran)
 	}
 }
+
+// The held image the comparison pulls to read is let go of once read.
+func TestTheHeldImageAComparisonPullsIsRemovedAfterReading(t *testing.T) {
+	var ran []string
+	run := func(_ context.Context, _ string, name string, args ...string) (string, error) {
+		ran = append(ran, name+" "+strings.Join(args, " "))
+		if args[0] == "create" {
+			return "abcdef0123456789\n", nil
+		}
+		if args[0] == "image" {
+			return "", errors.New("stop here")
+		}
+		return "", nil
+	}
+	_, _ = imageContent(context.Background(), run, t.TempDir(), "reg.invalid/m/server@sha256:"+strings.Repeat("a", 64))
+	if got := ran[len(ran)-1]; !strings.HasPrefix(got, "docker rmi reg.invalid/m/server@sha256:") {
+		t.Errorf("the last command was %q, not the removal of the pulled image: %v", got, ran)
+	}
+}
+
+func TestAnImageThatCannotBeRemovedIsNotSaidRemoved(t *testing.T) {
+	var said []string
+	run := func(context.Context, string, string, ...string) (string, error) {
+		return "", errors.New("image is being used")
+	}
+	releaseImage(context.Background(), run, []string{"a:1"}, func(step, format string, args ...any) {
+		said = append(said, format)
+	})
+	for _, s := range said {
+		if strings.Contains(s, "is removed") {
+			t.Errorf("said removed: %q", s)
+		}
+	}
+}