# DEVX-165: Manifest-aware dependency PRs and registry cleanup protection

## Problem

S03 (OBL-INFRA-548 REQ-3) requires an immutable delivery contract: infra
pins the sso-bridge release as {version, git ref, image tag, OCI digest}
in a JSON manifest. Two gaps in devx block that:

1. `create_dependency_pr` only regex-bumps a version string in
   pyproject/ansible vars — it cannot update a structured manifest with
   the resolved image digest, and it does not verify the producer
   artifact exists before opening the PR.
2. `clean_images` deletes all but the newest N tags — a tag/digest that
   infra still pins gets deleted once newer releases land, breaking
   deploys.

## Approach

REQ-1: `create_dependency_pr` gains `--manifest <path>` +
`--verify-container <owner/name>`: before opening the PR it resolves the
container tag's OCI digest via the registry `manifests` API
(`Docker-Content-Digest`), then updates manifest fields
`{version, git_ref, image_tag, image_digest, source_commit, updated_at}`
in the PR branch instead of a regex bump.

REQ-2: `clean_images` gains `--protect` (repeatable): named versions are
never deleted regardless of `--keep` trimming.

REQ-3: Regression tests for manifest update, digest resolution,
verify-then-PR ordering, and protect filtering.

## Files Affected

- `src/devx/ci/create_dependency_pr.py`
- `src/devx/tools/clean_images.py`
- `tests/unit/test_create_dependency_pr.py`
- `tests/unit/test_clean_images.py`

## Test Plan

- New unit tests per REQ; `make pytest-cov`, `make lint-all`.

## Deploy Plan

- Merge → devx release → consumer repos pick up via dependency PRs.

## Rollback Plan

- Revert; regex version bump and unprotected cleanup return.

## Acceptance Criteria

- [x] REQ-1: Manifest update + pre-PR OCI digest verification
- [x] REQ-2: `--protect` exempts versions from cleanup
- [x] REQ-3: Regression tests added and passing