declaration: an image may be named by the digest of its own configuration

A manifest digest is assigned by a registry on push, so insisting on one meant a
registry had to exist before the thing that lets a mesh have a registry could
start — a dependency the pinning rule created by accident, not a pin. The mesh's
own control plane is built from source and lives in no public registry.

A bare sha256:... names an image the machine already holds, by the digest of its
own configuration: immutable and unforgeable in exactly the way the rule asks
for. Absent, it says so plainly rather than failing at a pull nothing serves.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

internal/apply/apply.go

@@ -1154,6 +1154,15 @@ func ensureImage(ctx context.Context, cri, image string, run Runner) error {
 	if _, err := run(ctx, cri, "image", "inspect", image); err == nil {
 		return nil
 	}
+	// An image named by the digest of its own configuration is one this machine was supposed to
+	// already hold — built here, or handed over. There is no registry that answers for it, so
+	// pulling would fail somewhere that names a network problem instead of a missing image.
+	if strings.HasPrefix(image, "sha256:") {
+		return fmt.Errorf(
+			"image %s is not on this machine, and an image named by its own digest cannot be "+
+				"fetched: nothing serves it. Build it here, or load it, before applying this",
+			image)
+	}
 	if _, err := run(ctx, cri, "pull", image); err != nil {
 		return fmt.Errorf("pulling image %s: %w", image, err)
 	}