fix(pins): see what a Docker action executes, not only what it uses

[rldyourmnd]

Closes the gap #173 reported. Filed by an agent auditing macos-ubuntu-bootstrap's
consumption of these reusables — the cause was here, and it was in code I had just
rewritten.

The gap

The corrected walk (#179) collects uses: references from the parsed document at any
nesting. A Docker action does not have one. It names what it executes under
runs.image:

# ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc/action.yaml
runs:
  using: "docker"
  image: "docker://ghcr.io/ossf/scorecard-action:v2.4.4"

Verified against my own parser before fixing it:

refs my parser extracts: set()

The action is pinned by commit SHA. The image is addressed by tag. Retagging it
changes what every consumer executes while every pin in this tree still looks
immutable.

Five, not two

The issue named Scorecard and one other. With the shape visible, the walk finds:

action	image	reached from
ossf/scorecard-action	ghcr.io/ossf/scorecard-action:v2.4.4	3 scorecard workflows
bridgecrewio/checkov-action	ghcr.io/bridgecrewio/checkov:3.3.9	iac-scan.yml
wagoid/commitlint-github-action	wagoid/commitlint-github-action:6.2.1	pr-hygiene.yml
google/clusterfuzzlite/…/build_fuzzers	gcr.io/oss-fuzz-base/…-build-fuzzers:v1	clusterfuzzlite.yml
google/clusterfuzzlite/…/run_fuzzers	gcr.io/oss-fuzz-base/…-run-fuzzers:v1	clusterfuzzlite.yml

Two ClusterFuzzLite entries are on a floating major — the weakest of the set.

Recorded, not accepted

None can be pinned from here without forking the action. catalog/action-images.yml
records each with the workflows that reach it and what a consumer is exposed to.

This is deliberately the shape KNOWN_UNTAGGED already uses in
check_release_ledger.py, and for the same stated reason: an advisory tier that is
permanently red is an advisory nobody reads. Recording keeps the exposure reviewable
in the catalog instead of invisible in a sweep everyone learns to skip.

The contract runs both ways:

Mutation	Result
a recorded exposure is deleted	RED (caught)
an entry the tree does not reach is added	RED (caught)

So the list cannot quietly stop describing the graph, in either direction.

Left alone deliberately

An image: naming a Dockerfile is built from the action's own source at the pinned
commit, so it introduces nothing new. Covered by a self-test.

Verification

• 14 self-tests over in-memory graphs, no network — now including tag-addressed,
  digest-addressed and Dockerfile-built images
• validate_all — all tiers OK with GH_TOKEN · actionlint — clean