ci: key the reuse check on an image label, not a tag (318 step 3)

The shadow (dee93fa, run 4732) answered the gate: `imagetools inspect
--format` reads `.Image.Config.Labels` against this registry on buildx
v0.36.1. So the reuse check now asks the moving channel tag whether the image
it already points at carries this commit's `fc.revision`, and the r-<rev>
identity tags stop being published.

Three things this removes rather than manages:

A name minted per build that one thing read. Rule 145's narrowing is aimed
exactly there — "a third name for the same thing is upkeep for a model we do
not run."

The -main/-dev qualifier, and the CHANNELLED list behind it. Which tag you
inspect IS the channel, so the distinction has nowhere to live. cmd_identity
goes with it.

A silent expiry nobody wrote down. r-<rev> matches no branch of the
registry's keep_pattern (#3157), so identity tags were prunable past the
newest 10 — a pruned one costs a rebuild, in the safe direction and entirely
invisibly. A label rides inside a tag that has to exist anyway.

It also dissolves #3154 instead of deferring it: a scheduled base refresh
rebuilds :latest with the same revision label, the next unrelated push sees a
match and skips, and the refreshed base survives. Under the tag scheme that
push repointed :latest back to the older base.

The measured detail that shapes the code: a missing label returns an EMPTY
STRING and exits 0. Branching on the exit code would read "no label yet" as
success and skip a build that was needed. So it compares values, and every
uncertain case — absent label, unreachable tag, older image — lands as empty,
never equals a 12-char revision, and falls through to a build.

Reading the specific key matters too. The map carries the base image's labels,
and org.opencontainers.image.version sits right beside ours reading 24.04 on
the agent — a plausible-looking wrong answer.

Expect every artifact to rebuild once on this push: nothing carries a label
yet and it cannot be backfilled, since the reuse path copies a manifest and
config labels are not manifest annotations. One rebuild per artifact, ever,
self-healing after.

test_artifact_identity.py is rewritten around what is now load-bearing. The
CHANNELLED drift test had nothing left to guard; in its place the revision is
asked of git directly, so the file fails if the derivation ever stops being
"the commit this artifact's own shipped files last changed in".

tests/test_artifact_identity.py

@@ -1,140 +1,102 @@
-"""`artifacts.sh identity` is what decides whether a build gets skipped.
+"""`artifacts.sh revision` is what decides whether a build gets skipped.
 
-Milestone 313 step 4: build.yml asks the registry for `<image>:<identity>` and,
-on a hit, publishes NO new bytes — it repoints the channel and date tags at the
-manifest already there. So the identity has to be a true name for the content.
-Both ways of getting it wrong are silent at build time and only surface in
-production:
+Milestone 318 step 3: each image carries its revision as an `fc.revision`
+label, and build.yml reads that label back off the moving channel tag. Equal
+to the derived revision means the bytes this push would produce are already
+published, so the build is skipped.
 
-* **too coarse** — two genuinely different images share an identity, so the
-  second one never gets built and its tags point at the first one's bytes. The
-  live case is FC_CHANNEL: a `dev` and a `main` build of one revision differ,
-  and collapsing them ships an instance that reports the wrong channel forever.
-* **too fine** — the identity moves when the content did not, nothing ever
-  hits, and step 4 buys nothing. A commit sha would do exactly this.
+That makes the revision load-bearing in a way a version string is not — it is
+compared for equality against a value stamped into a real published artifact.
+Both ways of getting it wrong are silent:
 
-The Dockerfiles are read here rather than trusted, because the coarse direction
-appears the moment someone adds a build-arg without touching `CHANNELLED`.
+* **it does not identify the content** — a revision that moves when the source
+  did not (a HEAD-derived value, say) never matches, nothing is ever skipped,
+  and the mechanism quietly buys nothing while every lane stays green.
+* **it identifies the wrong content** — a revision that holds still when the
+  source DID change matches a stale label, the build is skipped, and the
+  channel serves bytes that do not correspond to the commit. This is the
+  dangerous direction, and it is what `test_artifact_paths.py` guards from the
+  other side by pinning the path sets.
+
+This module owns the narrower claim: whatever the path sets say, the revision
+is genuinely the commit those paths last changed in.
+
+The identity-TAG tests this file used to hold are gone with the tag. There is
+no longer a `CHANNELLED` list to drift (the channel is which tag you inspect),
+and no `identity` subcommand to refuse an unqualified call.
 """
 from __future__ import annotations
 
 import re
 import subprocess
-from pathlib import Path
 
 import pytest
 
-ROOT = Path(__file__).resolve().parent.parent
+from test_artifact_paths import ROOT, declared_paths
 
-# Only image artifacts have an identity — the extension is cached as an
-# ext-<version> Forgejo release, not a registry tag.
-IMAGE_ARTIFACTS = {
-    "web": "Dockerfile",
-    "ml": "Dockerfile.ml",
-    "agent": "agent/Dockerfile",
-}
+ARTIFACTS = ("web", "ml", "agent", "extension")
 
-CHANNELS = ("main", "dev")
-
-# docker's own tag grammar: [A-Za-z0-9_][A-Za-z0-9._-]{0,127}
-_TAG = re.compile(r"^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$")
-
-# `ARG FC_CHANNEL` in a Dockerfile means build.yml passes a per-channel value
-# in, so the channel is part of what the image IS.
-_ARG_CHANNEL = re.compile(r"^\s*ARG\s+FC_CHANNEL\b", re.MULTILINE)
+# 12 hex chars — the prefix build.yml stamps and compares.
+_REVISION = re.compile(r"^[0-9a-f]{12}$")
 
 
-def identity(artifact: str, channel: str | None = None) -> subprocess.CompletedProcess:
-    cmd = ["sh", str(ROOT / "scripts" / "artifacts.sh"), "identity", artifact]
-    if channel is not None:
-        cmd.append(channel)
-    return subprocess.run(cmd, capture_output=True, text=True, cwd=ROOT)
-
-
-def ok(artifact: str, channel: str | None = None) -> str:
-    proc = identity(artifact, channel)
-    assert proc.returncode == 0, f"identity {artifact} {channel}: {proc.stderr}"
-    return proc.stdout.strip()
-
-
-def bakes_the_channel(artifact: str) -> bool:
-    return bool(_ARG_CHANNEL.search((ROOT / IMAGE_ARTIFACTS[artifact]).read_text()))
-
-
-@pytest.mark.parametrize("artifact", sorted(IMAGE_ARTIFACTS))
-def test_channel_dependence_matches_the_dockerfile(artifact):
-    """The coarse direction, caught at its source.
-
-    Whether the channel belongs in the identity is not a preference — it is
-    dictated by whether the Dockerfile takes it as a build-arg. Adding an
-    `ARG FC_CHANNEL` to another image without adding it to `CHANNELLED` would
-    make its dev and main builds collide, and nothing else would notice.
-    """
-    per_channel = {c: ok(artifact, c) for c in CHANNELS}
-    differs = len(set(per_channel.values())) > 1
-
-    if bakes_the_channel(artifact):
-        assert differs, (
-            f"{IMAGE_ARTIFACTS[artifact]} declares ARG FC_CHANNEL, so a dev "
-            f"build and a main build of one revision are different images — "
-            f"but both derive the identity {per_channel['main']!r}. The main "
-            f"build would reuse the dev image and report the wrong channel. "
-            f"Add {artifact!r} to CHANNELLED in scripts/artifacts.sh."
-        )
-    else:
-        assert not differs, (
-            f"{IMAGE_ARTIFACTS[artifact]} takes no channel build-arg, so one "
-            f"revision is one image and a merge to main should reuse what dev "
-            f"already built — but the identity differs per channel "
-            f"({per_channel}), so every merge rebuilds it for nothing. Remove "
-            f"{artifact!r} from CHANNELLED in scripts/artifacts.sh."
-        )
-
-
-@pytest.mark.parametrize("artifact", sorted(IMAGE_ARTIFACTS))
-def test_identity_tracks_the_artifacts_own_revision(artifact):
-    """The fine direction: the identity must be the revision, not the push.
-
-    `revision` is the commit this artifact's shipped files last changed in, so
-    it holds still across pushes that did not touch it. Anything derived from
-    HEAD instead would move every push and never hit the registry.
-    """
-    rev = subprocess.run(
+def revision(artifact: str) -> str:
+    return subprocess.run(
         ["sh", str(ROOT / "scripts" / "artifacts.sh"), "revision", artifact],
         capture_output=True, text=True, check=True, cwd=ROOT,
     ).stdout.strip()
-    value = ok(artifact, "main")
-    assert rev and rev in value, (
-        f"identity {value!r} does not contain the {artifact} revision {rev!r}"
+
+
+@pytest.mark.parametrize("artifact", ARTIFACTS)
+def test_revision_is_the_commit_its_own_shipped_files_last_changed_in(artifact):
+    """The claim the whole skip decision rests on.
+
+    Asked of git directly rather than of the script, so this fails if the
+    derivation ever stops meaning what it says — deriving from HEAD, from a
+    build clock, or from a path set it did not actually use.
+    """
+    paths = declared_paths(artifact)
+    expected = subprocess.run(
+        ["git", "log", "--format=%H", "-1", "HEAD", "--", *paths],
+        capture_output=True, text=True, check=True, cwd=ROOT,
+    ).stdout.strip()
+
+    assert expected, (
+        f"no commit in this history touches the {artifact} path set — the "
+        f"derivation has nothing to stand on"
+    )
+    assert expected.startswith(revision(artifact)), (
+        f"{artifact} derives {revision(artifact)!r}, but the newest commit "
+        f"touching its shipped files is {expected[:12]!r}. The label stamped "
+        f"into the image would not identify its own content."
     )
 
 
-@pytest.mark.parametrize("artifact", sorted(IMAGE_ARTIFACTS))
-def test_identity_is_a_legal_docker_tag(artifact):
-    """It is pushed as a tag, so an illegal one fails at the registry — after
-    the build has already run."""
-    for channel in CHANNELS:
-        value = ok(artifact, channel)
-        assert _TAG.match(value), f"{value!r} is not a valid docker tag"
+@pytest.mark.parametrize("artifact", ARTIFACTS)
+def test_revision_is_a_legal_label_value_and_is_stable(artifact):
+    """It is stamped as a docker label and compared for string equality, so a
+    stray newline or a varying value breaks the comparison rather than the
+    build — the mechanism would simply stop hitting, silently."""
+    first = revision(artifact)
+    assert _REVISION.match(first), f"{first!r} is not a 12-char hex revision"
+    assert first == revision(artifact), "revision is not stable across calls"
 
 
-def test_a_channelled_artifact_refuses_an_unqualified_identity():
-    """Refusing beats defaulting. If `identity web` quietly returned the
-    unqualified `r-<rev>`, a workflow that forgot to pass the channel would
-    publish one image under a name both channels then reuse — the exact
-    collision the CHANNELLED list exists to prevent, reintroduced by an
-    omission rather than by an edit."""
-    proc = identity("web")
-    assert proc.returncode != 0, (
-        "identity web returned a value with no channel: "
-        f"{proc.stdout.strip()!r}"
-    )
+def test_an_artifact_whose_paths_did_not_change_keeps_its_revision():
+    """The property that makes skipping possible at all.
 
-
-def test_the_extension_has_no_image_identity():
-    """It is cached as an ext-<version> release asset, and its cache key is the
-    version. Answering with a plausible image tag would invite a second,
-    divergent cache."""
-    proc = identity("extension", "main")
-    assert proc.returncode != 0
-    assert "ext-" in proc.stderr
+    The agent's set is disjoint from web's, so the two must be free to differ.
+    Asserting they *are* different today would pin an accident of history —
+    what matters is that the derivation is per-artifact rather than global, so
+    this asserts each artifact's revision is drawn from its own path set.
+    """
+    seen = {a: revision(a) for a in ARTIFACTS}
+    for artifact, rev in seen.items():
+        touched = subprocess.run(
+            ["git", "log", "--format=%H", "-1", "HEAD", "--", *declared_paths(artifact)],
+            capture_output=True, text=True, check=True, cwd=ROOT,
+        ).stdout.strip()
+        assert touched.startswith(rev), (
+            f"{artifact}'s revision {rev!r} is not the newest commit touching "
+            f"its own paths — the derivation is not per-artifact"
+        )