ci: key the reuse check on an image label, not a tag (318 step 3)

The shadow (dee93fa, run 4732) answered the gate: `imagetools inspect
--format` reads `.Image.Config.Labels` against this registry on buildx
v0.36.1. So the reuse check now asks the moving channel tag whether the image
it already points at carries this commit's `fc.revision`, and the r-<rev>
identity tags stop being published.

Three things this removes rather than manages:

A name minted per build that one thing read. Rule 145's narrowing is aimed
exactly there — "a third name for the same thing is upkeep for a model we do
not run."

The -main/-dev qualifier, and the CHANNELLED list behind it. Which tag you
inspect IS the channel, so the distinction has nowhere to live. cmd_identity
goes with it.

A silent expiry nobody wrote down. r-<rev> matches no branch of the
registry's keep_pattern (#3157), so identity tags were prunable past the
newest 10 — a pruned one costs a rebuild, in the safe direction and entirely
invisibly. A label rides inside a tag that has to exist anyway.

It also dissolves #3154 instead of deferring it: a scheduled base refresh
rebuilds :latest with the same revision label, the next unrelated push sees a
match and skips, and the refreshed base survives. Under the tag scheme that
push repointed :latest back to the older base.

The measured detail that shapes the code: a missing label returns an EMPTY
STRING and exits 0. Branching on the exit code would read "no label yet" as
success and skip a build that was needed. So it compares values, and every
uncertain case — absent label, unreachable tag, older image — lands as empty,
never equals a 12-char revision, and falls through to a build.

Reading the specific key matters too. The map carries the base image's labels,
and org.opencontainers.image.version sits right beside ours reading 24.04 on
the agent — a plausible-looking wrong answer.

Expect every artifact to rebuild once on this push: nothing carries a label
yet and it cannot be backfilled, since the reuse path copies a manifest and
config labels are not manifest annotations. One rebuild per artifact, ever,
self-healing after.

test_artifact_identity.py is rewritten around what is now load-bearing. The
CHANNELLED drift test had nothing left to guard; in its place the revision is
asked of git directly, so the file fails if the derivation ever stops being
"the commit this artifact's own shipped files last changed in".

scripts/artifacts.sh

@@ -56,25 +56,9 @@ ML_PATHS='Dockerfile.ml requirements-ml.txt requirements.txt backend alembic ale
 # it: this is deliberately NOT `agent/`.
 AGENT_PATHS='agent/Dockerfile agent/requirements.txt agent/fc_agent'
 
-# Which artifacts bake the BUILD CHANNEL into the image, and therefore cannot
-# share a content identity across channels. The web image takes FC_CHANNEL as
-# a build-arg and reports it from /api/extension/manifest (milestone 271 step
-# 7), so `main` and `dev` builds of one revision are genuinely different
-# images — reusing the dev one on main would ship an instance that names
-# itself `dev` forever.
-#
-# ml and agent take no build-args at all: one revision, one image, and a merge
-# to main can reuse exactly what dev already built. That is not a detail, it is
-# most of what step 4 saves — merges would otherwise rebuild the agent's CUDA
-# image to produce bytes that already exist.
-#
-# Extend this list if a second artifact ever gains a build-arg;
-# tests/test_artifact_identity.py reads the Dockerfiles and fails if it drifts.
-CHANNELLED='web'
 
 usage() {
   echo "usage: artifacts.sh {paths|revision|version|tag} {web|ml|agent|extension}" >&2
-  echo "       artifacts.sh identity {web|ml|agent} [channel]" >&2
   exit 2
 }
 
@@ -124,9 +108,18 @@ strip0() {
 }
 
 # The IDENTITY of an artifact's content: the commit its shipped files last
-# changed in. This — not the tag — is what decides whether a build can be
-# skipped, because the published tag is only day-precise and two different
-# builds can share it.
+# changed in. This is what decides whether a build can be skipped.
+#
+# It is published as the `fc.revision` LABEL on the image itself, and read
+# back off the moving channel tag — not as a tag of its own (milestone 318
+# step 3). A tag would be a name minted per build that only one thing reads,
+# which is what rule 145 narrowed against; it would also be prunable under the
+# registry's keep_pattern (#3157), so the cache would silently expire.
+#
+# A published image with no such label reads as a MISS and rebuilds. That is
+# the migration path, not a fault: `imagetools create` copies a manifest and
+# config labels are not manifest annotations, so the reuse path cannot stamp
+# one and there is nothing to backfill. Each artifact pays one rebuild, once.
 cmd_revision() {
   echo "$(newest "$1")" | cut -d' ' -f2 | cut -c1-12
 }
@@ -157,50 +150,11 @@ cmd_tag() {
     "$(strip0 "$(fmt "$sha" %d)")"
 }
 
-# The CONTENT IDENTITY of a published image: an immutable tag naming exactly
-# what a build of this commit would produce. build.yml asks the registry for it
-# and, on a hit, skips the build entirely and repoints the channel and date
-# tags at the manifest that is already there (milestone 313 step 4).
-#
-# It is deliberately NOT either of the other two values:
-#   * the date tag is day-precise and last-one-wins, so two different builds
-#     share it — it cannot answer "is this content published?".
-#   * the commit sha moves on every push, so it would never hit, which is the
-#     redundant rebuild this exists to remove.
-#
-# The revision does both jobs: it is content-unique AND stable across pushes
-# that did not touch the artifact.
-cmd_identity() {
-  _art=$1
-  _chan=${2:-}
-  case "$_art" in
-    web|ml|agent) ;;
-    extension)
-      echo "artifacts.sh: the extension is cached as an ext-<version> Forgejo release, not an image tag — use \`version\`" >&2
-      exit 2 ;;
-    *) usage ;;
-  esac
-  for _c in $CHANNELLED; do
-    if [ "$_art" = "$_c" ]; then
-      # Refused rather than defaulted: an unqualified identity for a
-      # channelled artifact would let a dev image be reused as the main one.
-      if [ -z "$_chan" ]; then
-        echo "artifacts.sh: $_art bakes the channel into the image — identity needs one" >&2
-        exit 2
-      fi
-      printf 'r-%s-%s\n' "$(cmd_revision "$_art")" "$_chan"
-      return
-    fi
-  done
-  printf 'r-%s\n' "$(cmd_revision "$_art")"
-}
-
 [ $# -ge 2 ] || usage
 case "$1" in
   paths)    cmd_paths "$2" ;;
   revision) cmd_revision "$2" ;;
   version)  cmd_version "$2" ;;
   tag)      cmd_tag "$2" ;;
-  identity) cmd_identity "$2" "${3:-}" ;;
   *)        usage ;;
 esac