feat: use digests instead of tags for pinned images

[mayeut]

No description provided.

[Copilot]

Pull request overview

This PR updates cibuildwheel’s Docker image pinning approach to use immutable image digests (@sha256:...) instead of mutable tags, and adjusts the update tooling and tests to match.

Changes:

• Switch pinned_docker_images.cfg entries from :tag pins to @sha256:digest pins (with the former tag kept as an inline comment).
• Update config parsing to ignore inline # ... comments in pinned image values.
• Adjust test expectations and Docker warmup logic to work with digest-pinned images.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
unit_test/main_tests/main_options_test.py	Updates unit test expectations from :* to @* to reflect digest-pinned images.
test/conftest.py	Updates Docker warmup logic to handle digest references by committing to a tag and monkeypatching env vars.
cibuildwheel/resources/pinned_docker_images.cfg	Replaces pinned tags with pinned digests and records tag versions as inline comments.
cibuildwheel/options.py	ConfigParser now supports inline # comments so pinned image values parse correctly.
bin/update_docker.py	Refactors pin update logic to resolve and write digests (with cached registry lookups).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 5 changed files in this pull request and generated no new comments.