Require a digest on every oci.pull

[balajinvda]

Description

Independent of #448.

Measured on main: 23 oci.pull declarations across 8 distinct images and 7 digests.
One pull uses a mutable tag rather than a digest:

public.ecr.aws/docker/library/eclipse-temurin

A tag-only pull is neither reproducible nor safe to cache, since the same Bazel
invocation can resolve to different bytes on different days.

Reproduce the current state with tools/ci/bazel-consolidation-inventory, which
reports tag-only pulls by name.

Definition of Done

• Every oci.pull carries a digest.
• A check rejects a new tag-only oci.pull.

Resources

• Consolidate first-party Bazel code onto a single root module #448
• docs(bazel): propose consolidating onto a single Bazel module #445 (tools/ci/bazel-consolidation-inventory)