chore: use digests instead of tags for pinned images

[mayeut]

No description provided.

[Copilot]

Pull request overview

This PR updates cibuildwheel’s pinned Linux container image handling to use immutable OCI digests (e.g., @sha256:...) instead of mutable tags, improving reproducibility and supply-chain safety for manylinux/musllinux builds.

Changes:

• Switched pinned_docker_images.cfg entries from :<tag> to @sha256:<digest> (with the originating tag noted as an inline comment).
• Updated options parsing to support inline comments in the pinned-images config.
• Updated unit tests to expect digest-style image references and updated the docker image update script to emit digests.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
unit_test/main_tests/main_options_test.py	Updates assertions to match digest-based pinned image strings.
cibuildwheel/resources/pinned_docker_images.cfg	Replaces pinned tags with pinned digests (and adds inline tag metadata).
cibuildwheel/options.py	Adjusts pinned-image config parsing to allow inline comments.
bin/update_docker.py	Refactors image pin update logic to resolve and write digests instead of tags.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.