fix(vm): boot a digest-pinned image from the cache without a registry call

[balajinvda]

Summary

A VM sandbox boot from the registry authenticated with the registry before it looked at the root disk cache, on every boot, even for a digest-pinned image whose root disk is cached. This returns the cache hit first for digest-pinned references, so such a boot makes no registry request and keeps working while the registry is unreachable.

Related Issue

Closes #4581

Changes

• ensure_cached_registry_rootfs_image: when the reference carries a digest and image_cache_rootfs_image(bootstrap_image_cache_identity(digest)) exists, return the cache hit before client.auth. Authentication and the pull stay on the miss path; tags still resolve through the registry.
• The cache-hit events (Pulling, CacheHit, Pulled) move into publish_registry_cache_hit, shared by both hit paths, so a digest-pinned hit reports exactly as before.
• Safety: a digest names the content, and since fix(vm): bind cached registry images to verified manifest digests #4342 a cached root disk is published only after its manifest was verified against that digest, so the registry cannot add anything on a hit. Behaviour change: a host whose registry credentials were revoked still boots digest-pinned images it has already cached, as a kubelet does with IfNotPresent and a digest-pinned image.
• Measured with openshell-driver-vm v0.1.3 (e1f3c82c) on arm64 hosts against a remote registry with the image cached: registry authentication and resolution were about 1.9 s (p50, 96 boots) of a 2.5 s boot (numbers in VM driver authenticates with the registry on every boot, even for a cached digest-pinned image #4581). The same code path authenticates on every boot in v0.1.4 (5a7728c3) and on main at 909f336b6, which this change is based on; since fix(vm): bind cached registry images to verified manifest digests #4342 a digest pin skips only the manifest request there, not the authentication.

Testing

• Checks appropriate to the affected code and behavior pass: cargo fmt --check, cargo clippy -p openshell-driver-vm --all-targets -- -D warnings, cargo test -p openshell-driver-vm
• Unit tests added/updated (if applicable): bootstrap_registry_cache_hit_for_a_digest_pin_makes_no_registry_request (stub registry): a miss authenticates and fetches; a cached digest pin makes no request; a tag for the same content still resolves. Without the change it fails with ["GET /v2/"].
• E2E tests added/updated (if applicable)

cargo test -p openshell-driver-vm also fails stopping_a_sandbox_lets_the_supervisor_drain_before_closing_liveness on the test machine; it fails the same way on unpatched main, so it is not related to this change.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.