declaration: an image may be named by the digest of its own configuration

A manifest digest is assigned by a registry on push, so insisting on one meant a
registry had to exist before the thing that lets a mesh have a registry could
start — a dependency the pinning rule created by accident, not a pin. The mesh's
own control plane is built from source and lives in no public registry.

A bare sha256:... names an image the machine already holds, by the digest of its
own configuration: immutable and unforgeable in exactly the way the rule asks
for. Absent, it says so plainly rather than failing at a pull nothing serves.

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

internal/declaration/declaration_test.go

@@ -219,6 +219,32 @@ func TestAnImageMustBePinnedByDigest(t *testing.T) {
 	}
 }
 
+// An image the machine already holds, addressed by the digest of its own configuration.
+//
+// **The form a first machine needs.** A manifest digest is assigned by a registry on push, so
+// insisting on one means a registry has to exist before the thing that lets a mesh have a registry
+// can start. The mesh's own control plane is built from source and lives in no public registry; a
+// machine that built it, or was handed it, names it by what it is — a content address, not a name,
+// and immutable in exactly the way the rule asks for.
+func TestAnImageTheMachineHoldsIsNamedByItsOwnDigest(t *testing.T) {
+	held := "sha256:" + strings.Repeat("b", 64)
+	if _, err := ParseTrusted([]byte(`{"declaration":1,"resources":[
+	  {"id":"control","type":"container","name":"mesh-control","image":"` + held + `"}
+	]}`)); err != nil {
+		t.Errorf("an image named by its own digest was refused: %v", err)
+	}
+
+	// Still a digest, though. A truncated one names several images, and which one ran would be
+	// whichever the runtime happened to match first.
+	for _, bad := range []string{"sha256:abc", "sha256:", "sha256:" + strings.Repeat("b", 63)} {
+		if _, err := ParseTrusted([]byte(`{"declaration":1,"resources":[
+		  {"id":"control","type":"container","name":"mesh-control","image":"` + bad + `"}
+		]}`)); err == nil {
+			t.Errorf("image id %q was accepted and is not a digest", bad)
+		}
+	}
+}
+
 func TestAFieldTheNewTypesDoNotUseIsRefused(t *testing.T) {
 	// The field-set check must cover the types added last, not only the three it was written
 	// for. A package that carries a `content` is a control plane believing it asked for