refactor(docker): let a moving tag declare itself with the marker it already has

A pin outside semver was given its own 'docker-ref' marker on the theory
that every class needs one. That holds for a digest and not for a tag. A
digest pin declares something about the registry, that bytes move under a
standing tag, which no other choice says. A tag outside semver declares
that upstream publishes nothing orderable, which is exactly what
'docker-version' already means and what minio and the act runner already
carry on their version lines.

Keeping both would have put '# nocheck: docker-version, docker-ref' on
every such line: two keys, two checks, one sentence said twice. 'docker-ref'
is dropped instead. It lived in this one mapping, was never entered in the
suppression catalog, and no check ever read it.

The semver entry goes with it, because a semver pin never needs a
declaration. The test that asserted three distinct rules is replaced by two
that pin the separation where it is real: a digest marker differs from a
tag marker, and a semver pin has no marker at all.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/python/utils/docker/test_image_pin.py

@@ -33,11 +33,18 @@ class TestPinClass(unittest.TestCase):
         self.assertEqual(pin_class(f"  {DIGEST_VALUE}  "), DIGEST)
         self.assertEqual(pin_class("  3.0.1  "), SEMVER)
 
-    def test_every_class_has_its_own_rule(self):
-        rules = [RULE_BY_CLASS[SEMVER], RULE_BY_CLASS[DIGEST], RULE_BY_CLASS[REF]]
+    def test_a_digest_declares_itself_apart_from_a_tag(self):
+        self.assertNotEqual(
+            RULE_BY_CLASS[DIGEST],
+            RULE_BY_CLASS[REF],
+            "a digest is chosen for a reason a non-semver tag never carries, so "
+            "the two cannot share one marker",
+        )
+        self.assertEqual(RULE_BY_CLASS[DIGEST], "docker-digest")
+        self.assertEqual(RULE_BY_CLASS[REF], "docker-version")
 
-        self.assertEqual(len(set(rules)), 3, "a shared rule cannot express intent")
-        self.assertEqual(rules, ["docker-version", "docker-digest", "docker-ref"])
+    def test_a_semver_pin_needs_no_declaration(self):
+        self.assertNotIn(SEMVER, RULE_BY_CLASS)
 
 
 class TestPullReference(unittest.TestCase):