9e481a8

test: Check the test rootfs against its digests and the lint tools against their SHA-256

fetch-rootfs.sh takes the image's tag as it floats and extracted the
layer as it streamed in. The platform's manifest and its layer are
content-addressed, so each is now saved and checked against the digest
it is fetched by before the layer is extracted; a tag naming a single
manifest takes its layer directly, where the old path first requested
that layer as a manifest. The workflow lint checks actionlint and
shellcheck against their SHA-256. debian-trixie fetched and extracted;
a changed layer is refused with nothing extracted.