Fix release image cleanup

[p13i]

What changed

• Remove only the local AMD64 validation alias after release
  image verification.
• Add a regression test that rejects the former cleanup
  command.
• Rebind the deterministic demo evidence to the repair
  commit.

Root cause

The release workflow tagged a digest-qualified pull as
lint-release-test:amd64, then passed both names to one
docker image rm command. Removing the local alias also
removed the local image record, so Docker reported the
digest-qualified name as absent and returned a nonzero status
after every verification command had already passed.

The runner is ephemeral, and later release steps use the
registry digest rather than the local AMD64 image. Removing
only the validation alias preserves the intended cleanup
without turning a successful verification into a failed job.

Validation

• python3 tests/repository_test.py
• make verify
• Black 24.10.0 over all Python paths
• make codec
• git diff --check

The signed v0.1.5 tag remains unchanged. After this lands,
the release workflow can be dispatched from main against
that existing signed tag.

---

Written by Codex