Add image digest pinning and provenance strict mode

[mdheller]

Summary

Adds a bootstrap supply-chain validation lane and the first strict-mode image digest/provenance gate.

Changes:

• Extends AgentPod.runtime with optional supply-chain fields:
  • imageDigest
  • imageReferencePolicy
  • sbomRef
  • provenanceRef
• Adds src/agent_machine/supply_chain.py with bootstrap and strict validators.
• Adds scripts/validate-supply-chain.py.
• Adds a digest-pinned AgentPod example for strict-mode validation.
• Marks existing mutable-tag examples with imageReferencePolicy: tag-allowed-bootstrap.
• Adds validate-supply-chain to make validate.
• Documents the image digest/provenance release gate.
• Links the supply-chain gate from docs/index.md.

Validation

Canonical validation remains:

make validate

New direct strict-mode validation:

PYTHONPATH=src python3 -m agent_machine.supply_chain \
  examples/local-podman-llama-cpp.pinned.agent-pod.json \
  --strict

Production note

This is a bootstrap gate. It distinguishes mutable bootstrap examples from digest-pinned release-candidate examples. It does not yet verify signatures, resolve real tag digests, generate SBOMs, or submit provenance to a transparency log.