Implements: DEVX-165 REQ-1..3
- create_dependency_pr gains --manifest/--verify-container/--source-ref:
resolves the producer image's OCI digest via the packages API before
opening the PR, then writes structured manifest fields
(version/git_ref/image_tag/image_digest/updated_at) in the PR branch
- clean_images gains --protect: pinned versions survive --keep trimming
so a manifest-referenced digest can't be garbage-collected
- regression tests for digest resolution, manifest helpers, verify
ordering, and protect filtering